{ "Event": { "published": true, "date": "2025-11-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-02", "timestamp": 1762128181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c7f51e87-6516-41ca-b8fc-d94886ba8f5c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ad88be-b7f6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762093120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093120, "uuid": "99f0b47b-aa13-4e7f-9554-56a8f246b524", "comment": "Malware payload (Mirai)", "value": "0f540a836a47c12da03552b48da8d66c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093120, "uuid": "5a269667-e5dc-43dc-8d2b-1d6e93d78e11", "comment": "Malware payload (Mirai)", "value": "000dadf4802025825c354a6dc589f6f3d1da80d8b0dfbe35d7c30aa666eab0fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093120, "uuid": "47da402f-6606-4a7e-99c6-3e1f0fd3566e", "comment": "Malware payload (Mirai)", "value": "5db9cae9402a77d145b53cc15c2dabd8bce7e085", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093120, "uuid": "cc075d9c-cfdc-4c5c-97e0-3d7e2a264435", "comment": "Malware payload (Mirai)", "value": "e19f8fc5ae300e31a112a7abfc412f38c46346514a12145f4a1805018a88a64fcb5bc988f671d9be3d7605d7729fb5f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093120, "uuid": "357c3d41-72cf-4771-aae9-c61ed14f9d95", "value": "T192143B46EB404B13C4D61779F6AF024A3323D7A4A3DB73069D24AFB43F8675E0E62A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093120, "uuid": "cecf98e7-3fce-4d07-8c3f-29b0268d712f", "value": "3072:8QsnUiNitM7C5CC8gAmaaCKbR4ZbAEZTO9L+aWfyL/KwmX8AFKxx:8QsnUiNitM7C5Z8/maaCKbR4BAYEL+ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762093120, "uuid": "a252d943-9481-4460-a6e1-2ae1e489a204", "value": 192530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762093120, "uuid": "006b4078-a96d-4cf1-b898-a1aea499fca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093120, "uuid": "b64cd600-8abb-447c-982f-80d635fafb70", "value": "SecuriteInfo.com.Linux.Siggen.9999.19676.7227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ee9573-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095781, "uuid": "9a39c184-1be4-4810-a0bc-49e8f352e508", "comment": "Malware payload (Mirai)", "value": "cc2e528b3527c6bb15ae184642103d1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095781, "uuid": "0f836de6-d7c9-4427-af2f-ef8c849f077d", "comment": "Malware payload (Mirai)", "value": "0089959f915a6ac8ca27a97a43a3728acc8cb4ea34d782a343ad1c5771efb865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095781, "uuid": "d706afaf-7d88-4767-8f94-06eae7e21445", "comment": "Malware payload (Mirai)", "value": "b7e523e070e60b590d5253303e85cdff93687781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095781, "uuid": "d9c8b82b-cb12-4dec-b97d-f2146e522c7a", "comment": "Malware payload (Mirai)", "value": "8533bf314d4a9419bcacf5801582d13e674eff20c386a6a056b2c5804f8cdb545a2e75abf1b4037ae56339bbbb7938b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095781, "uuid": "9781348a-5342-46d8-add4-4abf48ea4d1a", "value": "T15E531A2236382F17D0E1A63D01F75B0577A179E95694C28FBE720E4BBD223502C16EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095781, "uuid": "92fe04b8-cf70-4da9-9f9b-12ad0c647e80", "value": "1536:e1DH06AciJghFYmaIbwwUCocF8w6pRxURBZ6V9:e1Zjocqnxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095781, "uuid": "39901b50-fb39-488e-a4fd-e9be47cb79e2", "value": 63567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095781, "uuid": "d41af929-0fc4-4bd7-a5d6-89b4d5f597cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095781, "uuid": "9eea5f9b-94e6-4c32-97c2-6553833c4692", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbbdca3-b817-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762107144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107144, "uuid": "bf734638-992d-4b9d-971b-5aa6d6c3ebea", "comment": "Malware payload", "value": "dd5ad7b51c0c377133f18b141d2de211", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107144, "uuid": "b2f3eb63-2352-4778-9a84-83ffe63a5611", "comment": "Malware payload", "value": "00cef478e2ba3d10e81076021d5f944613d1eeafcff46e2366a7512980ddee60", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107144, "uuid": "ecd6c60a-6eec-4f6a-be24-fb9807f41fd5", "comment": "Malware payload", "value": "18322dcb95b6e284e8237ca74843c2da7a12585f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107144, "uuid": "2e7631f2-5dbe-497b-be48-1e82ac414434", "comment": "Malware payload", "value": "e04c85a03a44b3c114f32afab097f32c426e79e8762fcdbd73a593478153c1cd5de38c3d91f1d4d7647d7bd2a1d026f8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107144, "uuid": "e3204cf9-d4a5-4bb6-96e8-61b830954697", "value": "T1C601DEDD60B2E7920649DF44A067CA3D90148ED1A390CF9D68CC0E72ADD4D15731AA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107144, "uuid": "70127ea4-9324-45f7-9b40-5085c3dd2a09", "value": "12:llHFS4UFKNIl5LF30LKGJD+OTJUJFJoabSTHbSTH8iHkYpyS:ouNI78KuD+4UJvoWw7wciEW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762107144, "uuid": "0272099c-9c2f-46fc-9b58-4475bf718c82", "value": 804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762107144, "uuid": "763700fd-4872-4c23-ac85-7e299c163c3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107144, "uuid": "a00beceb-7cb9-453f-86c9-a9ba3dd7cff8", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65f047a-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095297, "uuid": "81e07de6-50d6-4c71-b483-e4d18c7b4f47", "comment": "Malware payload (Mirai)", "value": "b65c1cc585ab13db62f3b5de360fc1b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095297, "uuid": "6ffa32d4-50b5-4e60-8492-a61989ede5a9", "comment": "Malware payload (Mirai)", "value": "014386d7a37e40ab73101e663393613597e163895c9a0ab4b7d642d77e0f1eb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095297, "uuid": "142986ad-2d3b-4f90-a830-58a3ccb9c68b", "comment": "Malware payload (Mirai)", "value": "bfe4c1396fb1956ee758697e74cd20e65c1ecdf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095297, "uuid": "eff03723-c8fd-41d7-8303-03d842ebacb8", "comment": "Malware payload (Mirai)", "value": "531240ad44171637a3d2376e496f084460eecaba48207296a30c26a9702be88594eb09b4bdbd70caac76865ad97bda51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095297, "uuid": "5922f8ee-5152-4d34-b2dc-4fc09c33b0b1", "value": "T1EB83285AF9814B11D4C5127AFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095297, "uuid": "3a4ab4c7-3b47-4256-b506-d037bdd15112", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYtI:BVE+2dmTEZCSHYMactW4Bi9gnS4V0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095297, "uuid": "e1e359cd-5b62-49b3-bfba-2ab46332946c", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095297, "uuid": "5c6c2578-fbda-4cbd-b989-bda8d6920f4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095297, "uuid": "43fa69f0-a6c1-4aff-80ff-7343b5d14c0f", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd6eb8e-b7f6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762093078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093078, "uuid": "c0a1b07f-e80e-476b-8f42-2aeb13b968f5", "comment": "Malware payload (Mirai)", "value": "c3724ca0eac19645ccae2a8c8c08ab72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093078, "uuid": "627ab588-83d9-4b0c-a605-ebbd93ab23a4", "comment": "Malware payload (Mirai)", "value": "021abe41af09ca4ca1d270f5a888f8528359dfb6cac5358d014c5f01e9995c4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093078, "uuid": "a72d2a95-f3f0-4e46-9bfd-6d50ee50531a", "comment": "Malware payload (Mirai)", "value": "1edfa92bbb0564a61b8ea5ede4b99316e73d3202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093078, "uuid": "56dbf558-e89a-4a22-a6d5-6a13225326ed", "comment": "Malware payload (Mirai)", "value": "128fddbcc59cc81d8141cd0f878a9bf203d8ee7b36bab05df9abea4e63b07c9b2aa43814a70951cd2ce3d1bc05d8f38a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093078, "uuid": "d816848d-05e2-4c0e-add9-7870077a69d2", "value": "T10473F26E090359F3E10A8CF0A5E2775EB8BD1B399093A9227B51D8E78D3F44D70836C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093078, "uuid": "23ec5bfc-1f23-45a7-973d-0f7fa7b8687d", "value": "1536:WKsciriATw+86bWsogdJuLW0kCL7UsDdDLqVJu2cFV8a6Y3Pl:1CiAs+86brrXUpfbdyVQkPY3Pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762093078, "uuid": "e7a81d50-8749-49ec-bcc7-41bd5f62635c", "value": 73884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762093078, "uuid": "7603b63c-b7a4-47f9-8696-097ddb28843d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093078, "uuid": "71657496-0098-4730-9f55-970dbfd77e36", "value": "SecuriteInfo.com.Linux.Siggen.9999.4536.13056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4bb802-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074287, "uuid": "7782b162-84c2-4758-8e43-629979a05e7a", "comment": "Malware payload (Mirai)", "value": "a239054a8bea01e7453a08a6c7e275ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074287, "uuid": "a1c986a8-d21e-44c5-b552-9ed461a4511d", "comment": "Malware payload (Mirai)", "value": "02db9bc7f93dfbfaec220f8045ac1a05305316fc1bc55ac2971b66874bab1baa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074287, "uuid": "bfee0399-dcb9-4c9f-9a8b-69cd42db86b2", "comment": "Malware payload (Mirai)", "value": "4b8c4cae479d9fb1e985886331abb535dae5f50d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074287, "uuid": "7f15a323-c7e2-4f34-86ce-5a0aec3ef1aa", "comment": "Malware payload (Mirai)", "value": "b53eefbb9eb964460f59088a47728444874367d53c70f75e8df24c2cdca514883c6989c25a57dec5ca5be9ba966b5427", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074287, "uuid": "4619632f-4458-4211-8779-080c4f07b05f", "value": "T150B3F80AFB110FBBDC6FCD3706A91B0525CC555712E97B3A7674C828BA4B64B0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074287, "uuid": "3b39c41e-996d-4985-a861-4dae08973bb5", "value": "1536:AdhMjrdc6TJBSicjJLXSN8yVaqIXMdZZfkyTOQed93p0DjnifzHef:AnMjJhSi/ORXMdEwSfzHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074287, "uuid": "1c5d6002-705f-4907-9bf3-53589269bbd2", "value": 114044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074287, "uuid": "553a1cda-ada8-4c01-a529-8cc5fda8bd13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074287, "uuid": "1dc37168-eab8-4cc5-9de7-8c7c3cd7fb99", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986c9b70-b7e8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762087006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087006, "uuid": "23d6a0f8-86eb-4f3c-9aa4-86be7f0b56c9", "comment": "Malware payload (Mirai)", "value": "022fffaa627733ff61223bd1a288f645", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087006, "uuid": "f411f856-98cf-47d2-a67d-31bf322275d5", "comment": "Malware payload (Mirai)", "value": "0336841522cf08828127a92bcc31bfe066142a492480810269236a1922f63c19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087006, "uuid": "83ddcf19-339e-4f64-b9bf-731bdceaafa9", "comment": "Malware payload (Mirai)", "value": "f95d02e8ea2b6e56576745fc85034b397dab537a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087006, "uuid": "c9369771-3e9c-4ff0-b007-9acfe2f0e328", "comment": "Malware payload (Mirai)", "value": "44d4ad8397098dfa9a14a13dca4b18d61e0df73b9df061f5218e17dae088dad4f9d082d66fbe948c5a780c6ee473ecbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087006, "uuid": "b89529b3-d5e7-465f-9b9b-9c485145dedd", "value": "T1B7E2F106E1AC41EEC7874B3611BE4B28FED3C6166070CCA95A865FC72B3960015ABBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087006, "uuid": "f99f1fbc-c540-4cfd-a758-48cecc338470", "value": "768:9JMsU7W3we3nN2pbNWvNZflHWJSCfIpVBe9gbo9Ky3:7B3nN2pBilH7Be9N9K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762087006, "uuid": "a148fbfb-0550-4d0f-92ab-69ced9b2c7e6", "value": 33676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762087006, "uuid": "685f8f57-60e8-4fbb-bea8-3606dc007648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087006, "uuid": "7c51f400-5375-4693-a0a1-db8550a8f6c8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5fa0c1-b7b6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762065382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065382, "uuid": "8bdf8cb9-67a6-4f79-b5b2-eea0ccd532ee", "comment": "Malware payload (Mirai)", "value": "b6677eb6e7472d5db8bb1b39869e8392", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065382, "uuid": "2848e020-141b-4871-a712-de6c41a7cfd1", "comment": "Malware payload (Mirai)", "value": "0500bac7997423b54ace823325eceb6dea4b2d8df9cabe8862f34f0f3b5756be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065382, "uuid": "d57af86a-cb5b-4354-8d18-d5ca559e6809", "comment": "Malware payload (Mirai)", "value": "49746655bd126d0032d25cbc5b08b116de7c01f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065382, "uuid": "bcca605e-ec64-486a-9db6-6ada3b496ea9", "comment": "Malware payload (Mirai)", "value": "9fa90a08f2af83a3323c798870c532ac9fdba4de301bcca7fd6f9568e8c19860d1044bc1c835082ab59bcdb17bc0a55d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065382, "uuid": "09dc5371-a713-4e76-9e92-02766f8a0074", "value": "T1F3F2F11F4D5DC02EC842053C235E96B67C2C81EFED5169B3D815329A977AB5042FED27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065382, "uuid": "32076a09-7e9f-4b0f-9e1d-40971d45708b", "value": "768:s9fldkeUcvbX9kXCzkr5//wrWPfoEuPoRwALBq7gUuEAJjYT6mGgs:s9Nbyy0y/EuewALsUURTjjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762065382, "uuid": "a1b457a3-f6dd-49c8-b8af-b119366187a5", "value": 37644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762065382, "uuid": "4676910c-b712-4fdf-aa4c-758da4f5e28f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065382, "uuid": "148f0574-201d-4f4d-bca9-3ad9f524185f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265d4bb2-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762094975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094975, "uuid": "187623c7-285f-4ac4-9ea9-5964a65dc553", "comment": "Malware payload", "value": "f5ed3a73b0b08707a7b1b41a380d89bc", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fydfl-bing-hk-cn", "colour": "#AE7988", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "xdf-v937ril-com", "colour": "#6225AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094975, "uuid": "d6799143-2d3b-4f40-8f18-650eb3473269", "comment": "Malware payload", "value": "0654cf0102f1602155b8e7e2d40ccd2426e19d879114ea4b00605f84e316af23", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fydfl-bing-hk-cn", "colour": "#AE7988", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "xdf-v937ril-com", "colour": "#6225AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094975, "uuid": "56063593-c59c-4bc9-8274-4264fd91e111", "comment": "Malware payload", "value": "752f2b800d9cb7bd8e2756fd04c496080ab83535", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fydfl-bing-hk-cn", "colour": "#AE7988", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "xdf-v937ril-com", "colour": "#6225AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094975, "uuid": "819a4810-2d4f-4b20-ba56-97b418e9256c", "comment": "Malware payload", "value": "93b99d4e8ec3e9cc19a21d7b7ec561ec7a212bd2807440d383c1efc16c0785ec1aa4e8ddb37ffa74fe8c2a14e204ecba", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fydfl-bing-hk-cn", "colour": "#AE7988", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "xdf-v937ril-com", "colour": "#6225AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094975, "uuid": "04248525-e30c-4788-b0a1-c065f1f39872", "value": "T1CF4733BBB268553DC4AA0B7240B2821069337E74B52A4C7E2BF0658ECF7B4511F3BB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094975, "uuid": "a13adb0c-7d0e-45a6-b23e-7f84fe94a904", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094975, "uuid": "c5dec305-8158-4108-866c-23c4fbac8ef3", "value": "393216:icISOzeu/ATCyX1Z8LP5kvqsAfnamvMg+MCl5xLf0vQ9Fs0XDk1+ytCRa//UJi6a:azeuoTCyFZ8GvCfn/velN+4kztvufU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762094975, "uuid": "d242693f-a204-4791-a8e1-50cadf2e4c3d", "value": 26794524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762094975, "uuid": "47c43721-4f5a-416a-83cf-976f86173ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094975, "uuid": "69edd9c4-ff4e-4c38-afec-3a1e976f909e", "value": "lkjnbfsx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf12d475-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072039, "uuid": "ccd1ceaf-1606-4e4d-aef9-892bce7b0049", "comment": "Malware payload (Mirai)", "value": "69d5dad695c79dfffbb1c3ba269355d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072039, "uuid": "607569f6-ae3a-4eb9-a56c-212083d15d46", "comment": "Malware payload (Mirai)", "value": "0893711b018b5aa84ad5a19e020a1e33a2adea1d246c7f7f86c0192c19e9e6ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072039, "uuid": "e3e34d93-41fd-42f0-9a18-e4567ff1efe4", "comment": "Malware payload (Mirai)", "value": "ae91ecbbf0e144fe5f773c2abbb51c6547bd6f8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072039, "uuid": "542ec24b-aa92-4ec2-9096-d4537f316728", "comment": "Malware payload (Mirai)", "value": "98b8fdf6452f1e0e830a1b2bf7424359ab8daecfb03e0cd16ec009e2117a0ec59655202a4b4b66a77ab27bc0234bcd6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072039, "uuid": "de47a8da-2929-48f4-9526-78a20f8696e1", "value": "T1FDB2D0AC070C2AE8DD0A843C539A0F5236350F21AAC3EC5FE529AD875F9A4D475927F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072039, "uuid": "ee999c12-1736-4d3a-a0be-e4ca8073c773", "value": "384:6eD8ZSH2LLZUYyGZbsOiTCClXS8QB2uCanEzK7WwSmd1JgGlzDpH7uNj1JA4S:6eD8ZSWvZHZbs1C2XoLCanGyWpi1JgGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072039, "uuid": "82066deb-2eb3-4f0f-b210-4339d680fa00", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072039, "uuid": "4849a6e4-b70f-49bf-bbbe-681df150e98d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072039, "uuid": "f5d97c7d-0ed9-4234-9095-7e18861eed1d", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f4c343-b7e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762087487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087487, "uuid": "a24d431b-b070-4114-bcb2-9f46edf338fc", "comment": "Malware payload (Mirai)", "value": "23bac83afdf3c278f364dc1b6c78618a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087487, "uuid": "e972aa2b-4b58-4ac6-ac62-b080fa04c147", "comment": "Malware payload (Mirai)", "value": "08c86b2501593c81c46e902381a5760d28dd5fc2ad89a986001395bb61e0dc6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087487, "uuid": "58300179-cb39-4852-b658-267e56eb9c21", "comment": "Malware payload (Mirai)", "value": "96b294d236ee23c670a3b014f9666b1fba30000b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087487, "uuid": "841bf812-3ca3-4b4d-afef-f7a385eacd7d", "comment": "Malware payload (Mirai)", "value": "5fbaef7658c7b2c2526194b802eb367f38e09a2978abd3745f5b01f114b50a599157da89ba6bb4bcb1600d70e9589ba6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087487, "uuid": "1756a9e7-ba42-43bd-a49e-eaee32a68e7b", "value": "T1DFC38DA47E4F7D92E2C7E37DCE484A62711B74F5C66182B4BE12431DC0E6DAE8AF0542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087487, "uuid": "60d14331-9255-4c86-a5d6-ef199191ad43", "value": "3072:m/wCEAXNq0qJv7NEW4d9ZdcRxu/gWe+W:m/wCEAXNq0qdaWW3SRIter", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762087487, "uuid": "47c8c0e8-dea2-4320-bbbb-a212925e6879", "value": 120664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762087487, "uuid": "2d30a4c2-bfcf-4541-b9e6-6d107ce7e593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087487, "uuid": "37161aba-dd24-47fe-8e82-1e92be0d9c25", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f0c7de-b7b1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762063411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762063411, "uuid": "a3dfd79c-1d3b-46a8-80fa-5efdba9b77e4", "comment": "Malware payload (Mirai)", "value": "121cf31c1d4752a1cc87afb6b140cc23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762063411, "uuid": "50a1c555-ac97-4f17-9f13-210851485b75", "comment": "Malware payload (Mirai)", "value": "0bc7bdccc8009ee9105f9fe7d96eb62c7aeda2ce42fc3cae02a51b939b2feed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762063411, "uuid": "af682943-bad3-4338-ae22-e87f62484870", "comment": "Malware payload (Mirai)", "value": "33e809a6939d56013fce1609bfae3d2b5951cb70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762063411, "uuid": "6138b1fd-6e18-4593-8fa1-0aef01ec9e57", "comment": "Malware payload (Mirai)", "value": "c7fef951bd41211ceb07df0ba35089636df2d4f33a06561f6db2522fce27b1b1ce50fe8517c927772d959a8d13e3b219", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762063411, "uuid": "ea0ac924-9129-4c8c-91eb-a095a08152d3", "value": "T1A1733A22B9360D27C5C0A87621F34775F2F6538A26ECCA1E7D620D4EBF2465031976FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762063411, "uuid": "2b67138a-01c2-4e70-b771-5c7482adbbfe", "value": "1536:PODjxpVIfWLDn6fwmb4ne4et+iUt5nssdtodctB:mpfvnpY0v/nswr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762063411, "uuid": "8283cb40-7317-43e0-9fc3-105dff5f37c6", "value": 74900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762063411, "uuid": "a0b53072-0d99-4a9e-86b1-d83b088e5151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762063411, "uuid": "2f4da575-3a7c-46e5-849c-eda0f4d2b498", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e4e171-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095057, "uuid": "bcab709c-93bc-4d9a-845b-8c34ab8bf00e", "comment": "Malware payload (Mirai)", "value": "c66b889173442a4a28ecacee4c817344", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095057, "uuid": "67224db7-b1a8-4df0-8ff4-80c528d1abc0", "comment": "Malware payload (Mirai)", "value": "0cb291cd58939d1be6f96da6feda04dff16623b5c29b331c1ad559ce79914d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095057, "uuid": "62a1e779-34e8-4ee8-9897-ed27d9f41a80", "comment": "Malware payload (Mirai)", "value": "9ebb60ad76f878d69e89a36e65317430f7b1e1ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095057, "uuid": "cac4da4e-ae8b-4506-8ab2-be77388b9fe9", "comment": "Malware payload (Mirai)", "value": "5c4a84873013f47f59d24d51f506d2143ec4e7423ae7d1cc89b5aaada0a2be64e3eb86fd2a19d0877d64eaea5d30f2c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095057, "uuid": "0228351f-298a-4d01-b3e0-fd99bcc84f7d", "value": "T1B5F2E03511FEF079CE3699F30DED58E8ED23A883266E0A73564562E50CFAE813E146C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095057, "uuid": "c107cc1e-a453-4285-a1d2-83036a65778b", "value": "768:KwS0nQr9tpJEuTbuF/OqQWENDt5jK4nLhWmLwEUx0nZZ:FOXX2tERnnUj1MZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095057, "uuid": "b4561439-d12c-4f79-a0c7-b334f8c7436f", "value": 36916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095057, "uuid": "bcfb4a19-f0bc-4452-8d32-045674e5b7af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095057, "uuid": "ff191bdc-5e26-4e87-babb-e28ca114444c", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace6ad38-b784-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762044091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044091, "uuid": "30312a8d-5dba-42a4-b131-5d286cc6a5e4", "comment": "Malware payload (Mirai)", "value": "053f04422a648ce01a973440f854c1be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044091, "uuid": "6e0060f9-dd21-4cf4-ade2-ec0ec10933d2", "comment": "Malware payload (Mirai)", "value": "0d6a5bd3c808d4845bc0b972562851a942d14e698fc91a5d70e1d7e3f6d36ea2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044091, "uuid": "1860152b-2b3f-4132-9467-80c230c66727", "comment": "Malware payload (Mirai)", "value": "9ab8b261b7d4b0f8b4331246a0917f82a983de15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044091, "uuid": "eb792355-9d5d-4a0b-b4aa-55bbf1ab61b8", "comment": "Malware payload (Mirai)", "value": "d3c583743d68239d8e711b680912398aa93d1ac7e4d9df2c36ea60b8eef8904388407233029a4899b527ed371cd413c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762044091, "uuid": "1c93b6ce-70c9-404f-8f9f-dc237a16a026", "value": "T1D403F1C466810132C6860373171FE15E453B8BB8C6E36243DA37AF1E7E9B7625463DD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762044091, "uuid": "537bb121-d668-45de-9c8c-3f0b8e261986", "value": "768:/vTpLM0I+xV75j9qHSdop9bjZ1izNyErnpeqnW9m587BUt:/LW0I+xVFsH7lHWNyElrnx55t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762044091, "uuid": "70090cf5-188a-4a5d-970c-409f8480b1a6", "value": 39156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762044091, "uuid": "adeecd5f-695b-41e8-bf6b-0f0fd19d95d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762044091, "uuid": "95b4d5e6-0b69-4645-9c44-e416b81f09a9", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf874eed-b7e8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762087072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087072, "uuid": "0a61c264-beb1-442d-91fc-45a03ed9196b", "comment": "Malware payload (Mirai)", "value": "472b3557d5a21136e574ce0887a730e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087072, "uuid": "f1b754bd-6139-4660-beee-b54ea176a9e9", "comment": "Malware payload (Mirai)", "value": "0dd676b07a73f9e6a3d5d10b6a7117868992bb203ae5d7e71ab2c9ae087974eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087072, "uuid": "6c51de0f-4e09-4d2a-9ce8-fa3e9d321ae4", "comment": "Malware payload (Mirai)", "value": "347f27e3659022281c4305985b2ac4a09e5f8014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087072, "uuid": "9af441d2-d82d-413a-b45a-4d678c543b46", "comment": "Malware payload (Mirai)", "value": "c4709f8eeb5dcb25c67b9cb46217ecbcd04f500d3ddf99e751ffe08b65ebcb713690c3d84c8264b12592c32d71478b76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087072, "uuid": "2084239b-882a-4e95-b128-7b5570d53861", "value": "T178632C02731C0957D6B3ADB0253F27E1D3BBE9A120F4B684651E9B899371E325186FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087072, "uuid": "bb9a28aa-5637-42a8-bce2-0a2ae3a3ecfc", "value": "1536:uwCvTYNDxogPWfhQwIAZ9H7wc8KMWiqvHok:wrYJSUWlF78KnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762087072, "uuid": "e3a6c569-6f95-4a39-8cf4-096163d70ad5", "value": 67352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762087072, "uuid": "6b700e64-9f6a-4d8c-8bcb-e6c196983c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087072, "uuid": "2b79a9df-edd3-4208-8ae5-4124b0ad1725", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e0ab2b-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095892, "uuid": "bcf91f79-8e6c-45d6-b145-34469e1abbbe", "comment": "Malware payload (Mirai)", "value": "da7e59c76f94e669ac6805678aa9e0e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095892, "uuid": "16b33853-295d-4324-80fc-cbd49cd686d9", "comment": "Malware payload (Mirai)", "value": "0dee512e90fbd9a9fcb0b21331f2b71eb09b76f215c71786c356e3013376bbc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095892, "uuid": "bf1676ce-0271-46ae-a08d-55035151d47f", "comment": "Malware payload (Mirai)", "value": "7d8512b63db8428057fd94b0212f74863983fc65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095892, "uuid": "99ece1d1-d3bd-49b6-b42d-51e2cf0d65f6", "comment": "Malware payload (Mirai)", "value": "e5cbee301285019db5709d691c032f0a21e7e97254a73d5cba0234321bb0bcf1fdde668bb11c0469194d7482366dd688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095892, "uuid": "b05b8084-89be-4890-845e-8e597957b9df", "value": "T13DC39D8BF2871491C82206F407CB4FDE7E6322C15F6B85E72D2A767A1C7A0CB5906F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095892, "uuid": "e76c1815-7420-439d-b246-ca6a09984cb8", "value": "1536:TpxuP2EKpd7q2KUh20W4KGSXvX4NKrGWChN6Zgkk/LWi:Lu0p02KwjtKGSgNKrGPhN6Zgkkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095892, "uuid": "6acb50ef-a8e2-4b45-878c-0b1b5b540348", "value": 124196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095892, "uuid": "44e2001a-22cd-44ec-ac9d-d28615c2be66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095892, "uuid": "15ecd25b-9a7d-4f05-9c2e-cf7a6e7e5a82", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee15426d-b7fe-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762096599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096599, "uuid": "5d521073-4044-43ce-b767-ed6682071296", "comment": "Malware payload", "value": "83315ffd2dd0b70ddd4ed6e46bde59fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096599, "uuid": "7e545340-f6b3-4862-be30-2a776d082d5f", "comment": "Malware payload", "value": "0e0d781871a69d19e9e5d04a6fb3a5dafab84039e84d8a8d7d3d3d78e7f4e299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096599, "uuid": "1c451c88-51cb-4bd9-9cb0-754f1b1886fc", "comment": "Malware payload", "value": "4e1f5ed38531083fd4d0ba89c40c82440c47fe10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096599, "uuid": "a6992406-7108-4d45-b699-2e7577d08950", "comment": "Malware payload", "value": "b4fe1e27282d1c077785e8a587a088405057a58a512a9e6ccf4d31a33bdb1e62aa4fa5686ee1c931e927810c91b1aaae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096599, "uuid": "6ceaa792-e877-422f-91d1-02432b224250", "value": "T119B58E13E99585E9C55EC078C31B963ABB7278890730B6EF1BD88E203E66F915F1C325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096599, "uuid": "84f2cf5a-31ec-402b-8fca-1a71062afe3b", "value": "928a1348fd22ec362e08a76d0569eb2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096599, "uuid": "c027cc5a-98c3-44c3-aff6-a81347fe5a46", "value": "49152:OQPFRktE+2mrjJN9HPAMS9a+140II227gbf3ovG1BI9YIU6iZ:OKI9tfG4aVn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096599, "uuid": "4e236322-8b5d-47f8-bb5b-1cdb639ee359", "value": 2487296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096599, "uuid": "f75c644b-5eb4-4c5f-b497-5c1e6ddd5e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096599, "uuid": "b5543bbc-f568-47c8-b551-da1b34916f90", "value": "audioFx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0f6aff-b807-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762100412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100412, "uuid": "c90f108b-2a2e-44f5-bdc3-cb6d58b1b3c4", "comment": "Malware payload (Mirai)", "value": "d7cf2435a4b284cc37cefb53e17c33b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100412, "uuid": "46e2567a-d7c4-4a43-a3dd-fe3e04cef6f8", "comment": "Malware payload (Mirai)", "value": "0e5ea8ef84a88b8a8f2933971c67e123dbc065a120695d1bb25188917b741eaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100412, "uuid": "dc96da7d-5e1f-4cc5-a120-5168347358d8", "comment": "Malware payload (Mirai)", "value": "f151e15510a30b6e53cc339c2659f05c62e299d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100412, "uuid": "18b494d4-c144-415a-a7dc-6e1729644046", "comment": "Malware payload (Mirai)", "value": "7f1927503fe9a7f4df7a0c0fbebe0bfa70a46f735ae72a115dd0b04ea393ffc7b3164d359c3cad0217afb439764179e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100412, "uuid": "b51fbef2-5f28-4480-95d2-8dd6eb395156", "value": "T1FCD36CC5FA83D8F7FA5301B11537D7328B32E83A5026DA52D3B96D35AC62950DA1B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100412, "uuid": "0aa08667-fe16-46fb-b285-cb80ea9ae88a", "value": "1536:JhR/4aAGCGAOn7W5RrAEhLlHYCW3pYNEkU3uwSYyP8yjY6QOJMMM3VCqVmvL:fC6W/pl5W3iNDU3PSbPYlPVoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100412, "uuid": "36a799e4-03df-4420-8330-b0448d2bd4e7", "value": 133616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100412, "uuid": "bba5f58e-aca5-4fa9-a941-b4a3ab6d3413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100412, "uuid": "da8280a6-0162-4669-9960-e43048392f62", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c994405-b7a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762059284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059284, "uuid": "1a493da0-d558-4e93-8abc-f1f6c3bc0686", "comment": "Malware payload (Mirai)", "value": "aecb27f116b0c1a0a75c8dc2572a29bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059284, "uuid": "a5f8c8cc-a38a-41e8-81e8-88dcaffef14d", "comment": "Malware payload (Mirai)", "value": "0ead112b89894f0fca5f0a351782009ebeebba7008938e30b71797bb1c4058ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059284, "uuid": "8bb3b436-1dd9-4661-bd4a-743a3bd520df", "comment": "Malware payload (Mirai)", "value": "ea28a8dfc01a8db0206f84265ae7ec6c2073c292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059284, "uuid": "139f3b3b-12de-42ec-ab44-58b6584d875d", "comment": "Malware payload (Mirai)", "value": "f1461589fe81f12fca23c7282de7df999cc6138e096e2ed6f2ddb578b96e5d118915c5860e5d334659ccf8fe76c94981", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059284, "uuid": "459a28c5-9db6-49be-9c67-79405da20709", "value": "T1CF631A02771C0E57D5A7AEB0253F13E0D3BBA99021F4BA84251E9B969372E3251C6FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059284, "uuid": "e039c21e-8d0c-4d3a-b7a1-2e31313c7a2b", "value": "1536:nfsWxUorCdpXYJbRVCyYXkJLNNvnkXhq5GHs:kWx2uYXkJRVn2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762059284, "uuid": "673f0416-075d-44d8-8a1a-033fd854a12a", "value": 66792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762059284, "uuid": "a8d5b2db-f00c-4a7e-a801-d34bfba205b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059284, "uuid": "57c7ea0d-fdd9-44c4-870d-25baf63a2088", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba2299c-b7ad-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762061430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061430, "uuid": "7f95b289-15de-46cd-aac6-0c0db1bec3e8", "comment": "Malware payload", "value": "ee66be021000874c7245cb63778de55e", "object_relation": "md5", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061430, "uuid": "2f742559-31b6-4dca-b3ca-f546e3535174", "comment": "Malware payload", "value": "0ff03b9c8bbe16156cf0b7344309520fa8a199acc4cd6b2a661aaaab4b5952af", "object_relation": "sha256", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061430, "uuid": "ec0ef964-d4aa-4e17-97aa-2d101cafceb5", "comment": "Malware payload", "value": "9049d0a320bdb624f3f930a2dba4ca91f2c55293", "object_relation": "sha1", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061430, "uuid": "8851bd6b-fe62-428d-afc4-5346666457c7", "comment": "Malware payload", "value": "b509a64244761a778e63af7114ed31ac93a7713aabaedea2e82b24713df2bd79c4e6f19ebc989268f466174ed02ca850", "object_relation": "sha3-384", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061430, "uuid": "260ace3a-5d73-483e-8932-24e1c3e125cc", "value": "T16291BB6D4A7DF41892E8D327E699FB176D8A1CEFC26CB81B66F74C6C1042AD041CA4C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061430, "uuid": "6c6a4e29-41f6-43ff-8192-4e92a3ea96c4", "value": "96:egV0uj40Ba+cIYuHekQ+Xw+4+g1+CS/v/vLUhA+sIq4Ie/WLUhGH4Ie/WLUhA+sR:pn42zHekpXJ1gUb/v/X+sIOe/Wxe/w+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762061430, "uuid": "f7dfa2c8-c605-4cff-8b89-fd0bc8ddbce7", "value": 4330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762061430, "uuid": "33ac6532-e430-4f36-8e2f-ee3696897860", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061430, "uuid": "5c40624c-6a77-4179-a21c-f7a8eba29d7c", "value": "0ff03b9c8bbe16156cf0b7344309520fa8a199acc4cd6b2a661aaaab4b5952af.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000c5f58-b83e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762123687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762123687, "uuid": "9f833a69-df0e-40dd-a740-e19511603944", "comment": "Malware payload (Mirai)", "value": "ecab1aa7aa41b8623b70c1d913aab55b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762123687, "uuid": "9248f3f6-bba0-4d21-be8b-eb38679251a3", "comment": "Malware payload (Mirai)", "value": "10c4fb3f8d7ea4db1371fb7b4d097ea13a8d31743bb3e01b1b1d1987c8e88252", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762123687, "uuid": "f7181af0-eb63-4fe3-b932-ae3852e3c6f0", "comment": "Malware payload (Mirai)", "value": "f68856d1f69db82ede4c418c95e68938d242dc29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762123687, "uuid": "85e1f1fd-c042-4c67-b185-8f6a651bd6ee", "comment": "Malware payload (Mirai)", "value": "e4317d313d3856a68d585f821288159f15ef0ad747c512e69ac2825ee39823e01e1616452391483c6d3654cb09a42643", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762123687, "uuid": "b9093948-8b92-4132-919f-a79de030ae6e", "value": "T128F35B07F5C184FDC896C1B44BAFF636ED72F09E1134B26B27D49A622E5DE201B2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762123687, "uuid": "0a593c32-ff15-410d-882f-469f84af7e81", "value": "3072:JBx7hJMJdMjDCgzTYJanIZlbupbiik2AKzopC6FyqJhYx1Ha:JH7heXIlFp8BIba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762123687, "uuid": "7051e7d7-1a83-4562-99e9-9be4d4d69426", "value": 159256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762123687, "uuid": "58d5113c-e3ce-4f9d-a4f6-61694bdbc5f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762123687, "uuid": "a9782cd6-2012-4d26-917f-e86e8c0b065b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfb8f87-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103793, "uuid": "adc50c10-6b8d-42cf-b753-ffb39b51af14", "comment": "Malware payload (Mirai)", "value": "14c980d772223f64cc0d3bdb76b53cf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103793, "uuid": "5c4af2ff-87bd-4a1f-9851-6872ed6af19d", "comment": "Malware payload (Mirai)", "value": "11119ef394055e30caaa7b44acddaf7fb2c9f102b1d7e947fe54aaa0bdbdd4f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103793, "uuid": "a91de337-2aca-4022-b9c2-dd9fc51c6761", "comment": "Malware payload (Mirai)", "value": "142affb8f5d4ce88467280b668cc5c482ee894e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103793, "uuid": "05ad79ca-54e3-4e08-9f7e-be610670c47f", "comment": "Malware payload (Mirai)", "value": "6dcb4a214b696a1ee962bbd649dabf4fbf71d8a603694e187c423e6ef784565ddd83cbce7356ec254e3a6e24a3804367", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103793, "uuid": "93d50253-6ea8-4a0e-bdb8-e797e6879382", "value": "T16D330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103793, "uuid": "db658306-14f6-4993-b383-fcacfa2b6e46", "value": "768:gduPBFnHooqR8qOCKq28H4Kg9e+TK806MMUVjzkfQXObHud2oG6:r/hqaJsDg9eqK806MHdkfQX6HuC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103793, "uuid": "0f43adf5-e1a8-4d67-b555-8067e97e2e26", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103793, "uuid": "c3339ec3-9d10-466c-8301-f09a7270f78e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103793, "uuid": "485b5f5d-d39b-4cb9-9541-5df8e1f74d55", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500ec301-b7e8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762086885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086885, "uuid": "ae3b9851-1aad-4125-80c3-3f3f60253a2d", "comment": "Malware payload (Mirai)", "value": "4a1c5edf65cd65f42620c37587204bb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086885, "uuid": "09c8ff55-05b0-4bbd-a3a2-bb3141889929", "comment": "Malware payload (Mirai)", "value": "11c54b296327c3a392acb02f7594e16db9501e1560b94b6edbfbd5313b85eb6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086885, "uuid": "dcd13608-2d79-4d40-a7e5-30ba2f91de09", "comment": "Malware payload (Mirai)", "value": "9af0ed2a0987cb3820279db0af58b49a1c296d62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086885, "uuid": "6e4b0673-b557-47b3-b016-435a3620086d", "comment": "Malware payload (Mirai)", "value": "9b02ebc9275a35201723e1ca117148b6be62bc17ffdb5b4e100d8c95f9d5bb0ba460c33f91daf2ea59f4527a2d1a227b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086885, "uuid": "44c5b906-8f88-4875-94ac-cfbed5916d4a", "value": "T1EAD31849B881AB14D6C615BBFE4F118A33135BACE3EE7213DD245B2437CB95B0E3A416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086885, "uuid": "a03bb46a-614f-4496-b517-733ede3c2de8", "value": "3072:grqmPt1cj75VCsO+t++rVpQFE2RUubabtOKBr3SCPYQgK1bNpjnzI:sqmPt1cj9VCsO+t++DQeK9babtOKBr3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762086885, "uuid": "a45824dc-4de7-4e3e-a35f-ed6956538ee9", "value": 132596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762086885, "uuid": "90a87a41-f163-4523-b9d8-7cf1eb350cc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086885, "uuid": "0162f1f6-b045-4e8d-937f-6e77e8db11ea", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca32209-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095174, "uuid": "768d4215-b7a6-4712-ba38-dbd9d38bfa56", "comment": "Malware payload (Mirai)", "value": "52191f0cd40934b65fb23966deb6e423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095174, "uuid": "97a7e43f-ec5f-4dae-9f45-ad51a99a7230", "comment": "Malware payload (Mirai)", "value": "121ba3d1548ef96ab2dc37624e6aa45e3459c3af8b756858b5e122343c8248e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095174, "uuid": "a3b0d93b-458e-4f3f-8b48-2f8e9c51f9e3", "comment": "Malware payload (Mirai)", "value": "a5d36abad52c2365eac36d867c3995c1f404278c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095174, "uuid": "a1fef390-a84c-437a-ac5c-4592c7531c6d", "comment": "Malware payload (Mirai)", "value": "9fc84537412657ce4cffdb59c77d3ef27265b2e7a1e3800a6ce880463343bcdbed493753df023c9a2707e93a776df8ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095174, "uuid": "d2e9dcff-5981-43e8-9541-eaaed7be53e4", "value": "T16CF2E174C1AC8FE2FD99DEB027D563D9BAF80E4F2711CCA330428F519A029114ACEAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095174, "uuid": "76b80b7a-6253-4b09-aa61-a0b3c6e93d4c", "value": "768:+eDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu22cS64uVcqgw09j:+CRocD0Lu/PWUWr/iuXcz4u+qgw09j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095174, "uuid": "e7ea3cd1-ab47-4989-be2f-a2ef7faf91df", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095174, "uuid": "7c425815-a0df-4a4c-8500-bf1bb764dc7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095174, "uuid": "a410f703-89e6-49f3-ba79-24b547bea030", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bc9ff9-b792-11f0-91c6-42010a9c0006", "comment": "Malware payload (Kamasers)", "timestamp": 1762049845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762049845, "uuid": "62be15af-14d8-4e02-a7d3-a1223b9011c8", "comment": "Malware payload (Kamasers)", "value": "8d8e31557b3d753a491e884098cb1cda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762049845, "uuid": "d2033e2a-1c94-46f4-9084-7e40c1cff8c6", "comment": "Malware payload (Kamasers)", "value": "12d5e3fdac938bef0d9c78e7905d6d1deaca21602aaef3fdc900b0063edb40f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762049845, "uuid": "81331e52-319a-4a0b-b4c4-ec61534e9216", "comment": "Malware payload (Kamasers)", "value": "d68393dc930c4237d9ce6e2512d82d44d7049692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762049845, "uuid": "ba9b9593-2593-4a3e-a66e-790197d5d1a1", "comment": "Malware payload (Kamasers)", "value": "8d55554ae22b38efce3d6f503af99c1731e7d0e2d396c0c0e15207b5553178dce27aa859f78cc74121b4be66db49549b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762049845, "uuid": "cb573066-0d30-4eb9-91a3-e384bf59cc43", "value": "T188D4F1217991C073D4A71971ACF9DBB58F2EFC224B9069CB67C40FBB49206C19735B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762049845, "uuid": "6e6bd7c5-18f9-4a3c-a0a3-85d883bb9c4f", "value": "88e9e53fbad6afc4927fe0f6233462bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762049845, "uuid": "8c8c7783-4013-4ec5-8569-6a00a97be361", "value": "12288:jT9szv8VTnzSN9ShaKN5eKbunW4OWWArhQDGdd:igVcWaU5eNWX+hqG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762049845, "uuid": "513d0770-5a89-463a-9f52-3f86252a3103", "value": 640048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762049845, "uuid": "c1770eba-2aeb-4c99-8db1-c3293882bb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762049845, "uuid": "c4436a79-29f0-4a20-8dab-c400b97781f7", "value": "SecuriteInfo.com.Trojan.DownLoader49.4307.17494.22029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea227c1-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103794, "uuid": "2753f4e8-1759-4fee-a7a0-65353860c5fa", "comment": "Malware payload (Mirai)", "value": "2210b8ea8edaacf4b49290af551aa9aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103794, "uuid": "f1191140-645e-470a-a5e2-d1b6934ed974", "comment": "Malware payload (Mirai)", "value": "1333c68691fb284d326b07b49dd4a01ac5b7452141185bb8959335c03687395d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103794, "uuid": "5de9a140-2f5c-4d09-9aba-a9bad65613da", "comment": "Malware payload (Mirai)", "value": "c6d0b94adc6af35d738cb94d945714722cbf8be0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103794, "uuid": "d06e57b3-4066-4842-84f8-fb628cc4c770", "comment": "Malware payload (Mirai)", "value": "94f9f9d2dd3a651e00f0d6f52f35bcbc74dc50590712d710164c69f124d7567defcbf917fbb6c1c87cb190c0379689bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103794, "uuid": "b735c2cb-a962-40e0-a0c0-dee8e7136461", "value": "T11E334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103794, "uuid": "44480b86-d901-42bd-94fb-9680c182a66f", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GcPS4yns96BktDgIPi8TwD:ivW3jdQGqt7Y+Z+3N9cGgI6bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103794, "uuid": "f5f1f752-e3c6-492f-8da1-1166ef0e1387", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103794, "uuid": "25884038-b8f1-4260-9365-7d76f8fdc100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103794, "uuid": "eb275e3a-3b54-4968-af4c-30754e3b952f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3642877-b7fa-11f0-91c6-42010a9c0006", "comment": "Malware payload (GhostSocks)", "timestamp": 1762094890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094890, "uuid": "34c97abc-4851-4f7f-b242-651bd126e87f", "comment": "Malware payload (GhostSocks)", "value": "4df7926cafd21d5757b7857f6e78b2c3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094890, "uuid": "67a5b937-a484-4d47-8ded-829e2479dba4", "comment": "Malware payload (GhostSocks)", "value": "13ef9363e161a1ac323bf113344637f7cb37359d287113804d877929f237baeb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094890, "uuid": "8cc66e85-d859-464f-af70-72464a71b229", "comment": "Malware payload (GhostSocks)", "value": "1680d40b5c8f720f46e7c893bf05f459e381dda4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094890, "uuid": "d6f7ef0f-7d41-4edd-b9e7-5a9279567ac9", "comment": "Malware payload (GhostSocks)", "value": "8662197295679de5bf5f24bc42200f8b36145f2a0edcc13c48fbf9df1dd977cb8c9122a32f7357d554fd4007ca751430", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094890, "uuid": "83e12faf-4c04-4a64-a6c4-d40a76a4de95", "value": "T123C623619B929013F1B63EB399BBD7D1C42E78AA3035458F61858D1E2160B07BF9B33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094890, "uuid": "13fd38e0-931f-4b2a-8b9c-0269f2bc20b9", "value": "490691c1e02a66f93031cea140117d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094890, "uuid": "2d6f76f6-2413-42c6-ba01-59181a86c3f1", "value": "196608:+XdzOFiE2TDt4FalE3JOnyax/FRCQADJulBG5iAYm+FmZWc9TDfztqUd:edzwotfE3qH9FfADJul13IWc9Hznd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762094890, "uuid": "629dab58-fc0a-4e70-aab1-4f5a1797418c", "value": 11780128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762094890, "uuid": "f737349a-b668-4d53-91fb-cefb6021cdc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094890, "uuid": "7c3b9eb7-5e2d-4cb6-b455-82e1d40fe059", "value": "Renewable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c067628a-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072041, "uuid": "aac2b9cc-4735-4a87-91a5-237a30e2de6e", "comment": "Malware payload (Mirai)", "value": "dc74c79d8018d48cf449568b687441f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072041, "uuid": "7fa1ab50-555e-490f-8173-f5ace14701a3", "comment": "Malware payload (Mirai)", "value": "14d2cddbe2d83b5041f8f111af7c1efb2f731266cbd1d8274b25fd5f813bcee8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072041, "uuid": "d6ab3d5b-d888-4f31-b246-b024edf8f02c", "comment": "Malware payload (Mirai)", "value": "3d5ee0c1fe152000fe8e3eb701a73e4b6f3574ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072041, "uuid": "7648dfda-d14d-4585-891f-4e0123bc4b8b", "comment": "Malware payload (Mirai)", "value": "adbd4bdc622011a83f0252a5ef58b288085d102c5d1fb2b12e2b98845cc8cf927670a01449decd1fab56078f8b22fd85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072041, "uuid": "da30697e-6e33-4d46-aad9-3e6c9fa8b64e", "value": "T14823F121222ADEB681B7CEF7CE7D08A2FADD0DF441D030A18267647497D4D66527D4CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072041, "uuid": "03a329f4-67e5-411e-8ec0-a2fbd40aae0b", "value": "768:s2rIJt9B2uWsPjH1Vi4cmZoq29q3UELJqqlpf/zAaD4stZGByRm:F8JTdxLi4citbLJnlpHzDD4DSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072041, "uuid": "d76fbc8a-0752-462b-a580-323454cecd7f", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072041, "uuid": "7caf63ca-a45e-45e1-97fe-19680991c393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072041, "uuid": "7c168cab-66fb-4a1d-b8be-8918c33c7503", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b9bfd0-b808-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762100534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100534, "uuid": "6faba1ed-ebf8-43b3-b0fe-298a5f491843", "comment": "Malware payload (Mirai)", "value": "345c774a9dc14234e02e899078edbb92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100534, "uuid": "7fe16915-9774-442a-af22-526e480eb9b4", "comment": "Malware payload (Mirai)", "value": "15ceb53c80aefb6fe982eb4dfdac00fd3d2713e7f2f234eb9dbc3e3f1be9e202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100534, "uuid": "3dee423b-ffa1-4fa4-8efb-8b56b5da511c", "comment": "Malware payload (Mirai)", "value": "d967c3b8e8f794130c5aada267434d00fca7efa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100534, "uuid": "fbd75611-8aab-4e7e-9351-56d03e2e4ab8", "comment": "Malware payload (Mirai)", "value": "fa2a51a153f932b9190819a869912faa4227f0470dc031272ecf3eb9de8680bd662eea2fd7bd80e1c014e558ac87bcab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100534, "uuid": "d16116d1-ec87-4bdc-b592-1eeadc2edde9", "value": "T1DDF2F109EC801349CA2573775FF15C0A4392DB2F716BDB1629D4BEA389612850FBA37B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100534, "uuid": "3c251ea9-e6e7-4d7d-a226-c68450f7e130", "value": "768:CdIlva+bbpZXpyHtt5MIIt671nEk1295OjUzru9BlEAT+rIFL2:GI98fASa795O4/gT+rea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100534, "uuid": "0684d63b-6781-4ee3-b192-7846243d4941", "value": 36332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100534, "uuid": "6fe68892-62ef-4269-969f-1e03bc67751f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100534, "uuid": "2b361e07-bf30-4c5c-9610-8777d5c51d44", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f989611-b7b6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762065409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065409, "uuid": "50d0d7ed-122b-41ec-a69b-b0d955affd19", "comment": "Malware payload (Mirai)", "value": "31bdc70de2400e78cfa90fa1e28815b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065409, "uuid": "adeedd70-2baa-4f7e-af76-91f678807ad9", "comment": "Malware payload (Mirai)", "value": "162a5f15004170515f6114abddb74104e1f8568f9724354e7b0d9687b815bc80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065409, "uuid": "0971e26d-4a18-4b7e-bf15-b9ab15bd20b5", "comment": "Malware payload (Mirai)", "value": "d3772a3bf6f74593cfdd3111eda19759e297be78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065409, "uuid": "b72ea581-3b65-4935-9d60-f44807e36e0b", "comment": "Malware payload (Mirai)", "value": "9a62f2345c072212bdbacfa4cb716e7c93b4d245555e9527fa1fc22446304342a0d32e56fbe2636789504984b5f7f7b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065409, "uuid": "440fb278-fd75-4ec2-b614-0ee465545fb6", "value": "T1DF93EA0ABF910EFBDC6FCC3749E91706258D650A21A97F3AB974C92CB90B24F15D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065409, "uuid": "d09f10be-29eb-407b-9b6e-e991393ae47c", "value": "1536:VmEP4jmtDf8LI+33AbOQC6M+oEG+QVKAwpdQyH9Ct:VF4jUDa6ToEa4dfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762065409, "uuid": "55757fcb-18f8-4a64-b0bf-ecfad129ef9f", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762065409, "uuid": "0e1b9ed0-598c-49ca-b408-f6584bec30c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065409, "uuid": "89e1c4a7-c8a1-46b9-9a8c-11af63d2aac2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c4ef6b-b822-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762111805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762111805, "uuid": "6f1f3844-f011-459a-b24b-4ca232e3cdbb", "comment": "Malware payload (AsyncRAT)", "value": "974e8224bf2770c1f7fe9ab2b0166a6a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762111805, "uuid": "b2330a88-e28a-41ad-97b5-ae9b3fbf3ac1", "comment": "Malware payload (AsyncRAT)", "value": "19738529a0e8634d5a32cd0fe8c58f900f99fa9622164c54fc56b9f4d088d0a3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762111805, "uuid": "fca854e7-b83d-480c-86fb-31d9140736f5", "comment": "Malware payload (AsyncRAT)", "value": "0f51e5803469429795cd15a5ac3446da91c8fed5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762111805, "uuid": "1735b14a-e2d1-4b86-8c29-a64fa3851d65", "comment": "Malware payload (AsyncRAT)", "value": "af14df8d1e48daf73a2ac151a97cc20c30d99a9e16fbc864b8b83175970a531f6c3661e2353cfb3327fb442ee25a90c9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762111805, "uuid": "ddd19587-5a80-4222-ba72-3bfa99155bb6", "value": "T18E53E7013BE98029F3BE8F7469F3628546FAF4AB2D12D54D1C8514CE0632B869951BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762111805, "uuid": "15df3b05-49de-410d-9407-b2f210b81bf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762111805, "uuid": "c87fe4e3-3cee-41f8-9f3c-0c5f51df6572", "value": "1536:WZUuaU62kBo9KuvUYFAu5bhAPCG1NrmTGPdx:WZJaU62kgKuvUYFV5bhL0EUdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762111805, "uuid": "529a99da-d173-46c5-a653-8c19b4846b23", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762111805, "uuid": "64906ce2-4fc9-42ba-9774-362d47f6cf9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762111805, "uuid": "17eef41d-68cf-42e0-8357-60daf55b86b1", "value": "19738529a0e8634d5a32cd0fe8c58f900f99fa9622164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6d8c81-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762095957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095957, "uuid": "eac8cf19-2bd8-4a2e-87b9-8b6d76052787", "comment": "Malware payload (AgentTesla)", "value": "082db05dcad65e9a378e184b864bdc22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095957, "uuid": "949ae480-d957-4e35-829d-576417c7b385", "comment": "Malware payload (AgentTesla)", "value": "198f0d10b03f841f0e771ee2f96ea50c2c1d402fe70b90bfc36943d293e8dd2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095957, "uuid": "d5fd3ff5-a078-4348-b639-6215c4443228", "comment": "Malware payload (AgentTesla)", "value": "20419d35ef9b1cf52345b9982ec86457f32dff2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095957, "uuid": "061abfce-7f82-4c6f-97ed-d0124b3eaba2", "comment": "Malware payload (AgentTesla)", "value": "a09f04c6fc6af530d8ad02f781bd780fe576267d5f4f9ffe1fe0eefeada8a4e78b9a43cb72bb543b2d11ad4582ab5a9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095957, "uuid": "3afc8bc8-a8dc-437f-9373-d8f63dbf4e6a", "value": "T13D4533F3DA5DFCAC0BAE52265B2C9E11D4218C0F12616315466F9A6C3C2D1EFEDAB710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095957, "uuid": "dd8ebad4-d081-4ce6-90bb-b071f449ba8c", "value": "24576:aSiD8wkc/ZGLR3DnHBPC/K0YFFw/uZpFLUFtvFkq8XJmoZxT:abD+0wFnHU/K0am/uZpFLU38XJmoZxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095957, "uuid": "b435e067-ab7b-43c9-a77c-5ad16c92e77e", "value": 1268611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095957, "uuid": "f306188c-475f-4994-8a2d-f5cc584dcd21", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095957, "uuid": "c48079c2-8799-4cee-bd83-01a195f38f5d", "value": "NK25091092.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af52000f-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103795, "uuid": "8b6bcb26-c541-4e5b-8969-0471e8e81cd6", "comment": "Malware payload (Mirai)", "value": "646e92fe0ef2eec6bf29f171cbd54dbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103795, "uuid": "299a1174-74e8-4c47-9566-584df0a72a59", "comment": "Malware payload (Mirai)", "value": "19c5208a1f52346f182b48b632a8bf47d7f40d5ea281580d4addfdaf0e54080a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103795, "uuid": "ec20560b-21bd-460c-bb44-1a4fc40afb11", "comment": "Malware payload (Mirai)", "value": "9ac9a528a45aa0f44935e267f07efacc8888fcb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103795, "uuid": "02e88bff-ccc8-4c82-a294-b1d015d7f46a", "comment": "Malware payload (Mirai)", "value": "4cd000991d35fb3ba6993fd37af82bd035c211b9b45c9b2c2cf8a5f7e2c7c112d67e8458a2591754e1e28c884b56089c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103795, "uuid": "2d6d3a3d-d52e-4d0b-83c5-f21b8e9b3b64", "value": "T16873A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103795, "uuid": "23767ea3-9d61-4742-b14b-08bb7b9cac92", "value": "1536:zJPEBmW5iNWqcGT8wnXHZ84OqdZerESt4:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103795, "uuid": "012d0886-a858-45d7-8849-af1e858cf880", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103795, "uuid": "37f3f39e-c575-4e0e-9002-17913dae1c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103795, "uuid": "fccf4941-ba98-4eb7-bc07-df1ca77eaac5", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f0f4aa-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095060, "uuid": "a7a1cfab-7f62-4b42-9e9e-3f5bc1292134", "comment": "Malware payload (Mirai)", "value": "a93dc0cd5498481e49b19124a1b8f033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095060, "uuid": "ea591615-d255-4e02-a9cc-7d3db49ed3cc", "comment": "Malware payload (Mirai)", "value": "19e8d298828636c379fb28d72e9b2794f6277efabaa678b761da9f5abdf0e6f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095060, "uuid": "71553aee-a5c2-42e7-b3e1-4242e08ba352", "comment": "Malware payload (Mirai)", "value": "8aaf54d6aa063314927445f07eafe56e7be0a3a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095060, "uuid": "a8755685-c747-41b2-b5c3-ee25d9cb7898", "comment": "Malware payload (Mirai)", "value": "51a8bb07221569466b2a69461ce6f381de295c5e652c69c8ba976a5f247bbc30681f7450d86bc72d1b3c939dbc7e8b2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095060, "uuid": "b7e237f6-2b06-44f5-a9a2-1e4fab8b0a0d", "value": "T14203E155A461B06AC91F2C3F638E11AA1990F2D5715A2B7B5338CCC8FF36C5B94DD8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095060, "uuid": "c539215c-1327-4ee5-8ea9-fc56590ab940", "value": "768:YF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu08V/vjLjcvM:al5JnsrXvrKy9QjyBZLvDmR0e/T2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095060, "uuid": "45b5d2e8-1645-4389-9a1b-f0ff8888f43d", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095060, "uuid": "6aa89409-5bda-4c3a-9335-b69bac50b1a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095060, "uuid": "63339718-2ebb-41ac-857e-14f7b1ec0dea", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d84cf9e-b807-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762100168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100168, "uuid": "57570841-b933-40a0-9fd8-1d85e2f3ed0a", "comment": "Malware payload (Mirai)", "value": "fbf6bb336f808d1adf037599a08ba8e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100168, "uuid": "97bb2fb1-6a93-4f61-9de8-bf98bc925ff8", "comment": "Malware payload (Mirai)", "value": "1a698a6c4f1c78ea5caeb43b37a8f830f102e90aa66b71c2a8f7b46ad67b2017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100168, "uuid": "d64f23d6-2d2e-4cee-b51e-2ab5a79e9d3c", "comment": "Malware payload (Mirai)", "value": "9a1af2e46eed7d69aa82e9529842812a22094fc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100168, "uuid": "0f8c55ae-b3a4-4058-913c-35cfaac20715", "comment": "Malware payload (Mirai)", "value": "13ae8f1869d2c5dfc766e929a4e5350a1a26897ace6fac238e98fe50e585f742b0e73e30dbe88a97dd696133d82e2b6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100168, "uuid": "415e0a8c-615e-4417-b273-0f1095aa9cb6", "value": "T18CC312EF931EBB7466077973664F25C80A55F1002C4B4B9D0FA671E95CAC2E77F10A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100168, "uuid": "54a0795d-4508-4613-9cf7-b03894cbc1ca", "value": "3072:peIcGzaUUC3Hj2kIFgQiG8jPLfu11ReXdcS:peIPALmQLEPLm1Xidh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100168, "uuid": "14987fbe-a180-4dce-8c89-da8c86ab64ef", "value": 122364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100168, "uuid": "b282c98f-0449-442d-b1f7-54e30dc1e19e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100168, "uuid": "09acdb19-9ad9-4357-955f-53475f861c4e", "value": "2.off3.ru", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97076dcb-b7dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762081850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081850, "uuid": "4a3dba59-bbd6-4c3d-b63e-5a76dbaf0a98", "comment": "Malware payload (Gafgyt)", "value": "5dc3d8a70538023cc57797c77229d3e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081850, "uuid": "1030b07a-3750-4c0f-9562-24f12e45dc09", "comment": "Malware payload (Gafgyt)", "value": "1a69acae06c495d68ca9c45e1aaa0704d4148cbeceb09319823b1f28bc310390", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081850, "uuid": "77f39710-b0f7-4306-bc77-77f6f0e1702a", "comment": "Malware payload (Gafgyt)", "value": "49e95bcd2e6e43901272e3ab535a03d0b7346bf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081850, "uuid": "6bb968be-7a9d-4eba-8258-6d13d7054701", "comment": "Malware payload (Gafgyt)", "value": "0200bea550a371192dad7528f8f698913eeba0ccaedc62e75c4fbad42fe0a0068fc9526d5c505a327142534b586f084e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081850, "uuid": "f0bc81c7-651b-4afc-b9a9-e61d44620752", "value": "T1E6D32A36E4518F73C0836AF2286A9D310F15D5D31BAF2686227857F04B4F5CEB44EEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081850, "uuid": "20da4372-1829-4bf4-8bf8-800ea40c1fdc", "value": "3072:KIKkkTnBz/yPMWrjHlTOD3JK5hpqCmAK0qW6MyoQ6:dKkUnBGP/eJK5hpqCmAK0qW6MyoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762081850, "uuid": "165350b4-83e8-44bf-82b1-c624b57ed2b3", "value": 140197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762081850, "uuid": "17c8e4ff-36fa-4c76-b989-fa4702bd6614", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081850, "uuid": "c711cdb9-8a8a-4bbf-b317-07fb13efbbcb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283a6e23-b7dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762081664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081664, "uuid": "0dc98856-d2ef-415d-9b02-e4fb52de467a", "comment": "Malware payload (Mirai)", "value": "22111775362f728c2c232b6e9c9c1faa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081664, "uuid": "a6e4e03c-989f-40b8-82e1-23274db2e32d", "comment": "Malware payload (Mirai)", "value": "1ac2f532f72127bc456398bff7812efb4a09828104be5a68666e119571088466", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081664, "uuid": "b8896294-8069-4e94-9b14-1e22f24bb6ff", "comment": "Malware payload (Mirai)", "value": "ea64704dbe8fa7c89c3e2abfc8780a485ee4ad7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081664, "uuid": "2e90f98a-e838-46ee-a5ca-71cb1fc67ff7", "comment": "Malware payload (Mirai)", "value": "4b2aa92c7e5163d7784f7c07248b124926071f9a46b4ac91ac217d22fd308b36a3b81a23d8b4cd5b5f21821eeadfa9f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081664, "uuid": "e610523b-7124-46f1-b294-d98e35205d47", "value": "T145631891BD81AA22C2E12376FB6E418E372563A8D2DF3307CD226F1137C695B0E67751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081664, "uuid": "0c7aa801-0ba1-4c08-8761-ebc0c8e0765f", "value": "1536:yPrCmvsTr0D0v/a/T/IkuU+17YC1VfJQ6tupTLOU0ojto8KhZo:yPOUsn0ov/qdG1xPxQ6eg8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762081664, "uuid": "330f1895-ffd2-4d2c-a56b-2592bb76ce93", "value": 70792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762081664, "uuid": "6bd0b7c2-19f7-4bf3-bc46-3b2dc067ae77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081664, "uuid": "cd60b960-7d3f-4be3-9344-325e4cf2e1e6", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e387d014-b7f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762091427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091427, "uuid": "8b775096-156e-4a57-b454-30bab166859d", "comment": "Malware payload (ACRStealer)", "value": "3df1bf18e0f6cc5cd05436eed41a940e", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-192-15", "colour": "#2900EC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091427, "uuid": "baa05d24-4c80-461d-8b03-e5c24eeb8608", "comment": "Malware payload (ACRStealer)", "value": "1c498b3ba5d3c2c62bbd17ae695748466dd63bf852551d919f44ff91c628dca0", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-192-15", "colour": "#2900EC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091427, "uuid": "579ccf48-4128-4d55-b395-9cb62fad55c7", "comment": "Malware payload (ACRStealer)", "value": "8af42f401befd1656f2b3fbb48c3b9fd016746db", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-192-15", "colour": "#2900EC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091427, "uuid": "029e28cc-b4ee-4648-af13-1eb7252b421f", "comment": "Malware payload (ACRStealer)", "value": "70cb924d6edca503ce1fd3ef09f36ecdefc14872c5f69768de5f8e1009a2f4c969c84388b705d40a24879d7ec425c2d8", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-192-15", "colour": "#2900EC", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091427, "uuid": "1f8ac5c3-5d50-49d7-a16d-8af7c9d4a60c", "value": "T15D573371D0992CE8C8723C95F359696A639F731DA13503EE13322BC2E9FB79053EA449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091427, "uuid": "5986d9a7-0898-4163-876e-1e08ab0114ac", "value": "786432:8Xo0SSrzO03qjdCAoZTJHI0eIeQgk199HN7GJ4VTP0:8XoT2zOwqf6I4sa9HNgCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091427, "uuid": "b738d59e-0792-4a6d-a015-ad9a6a02061e", "value": 29589455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091427, "uuid": "1db435ce-3e80-4b86-9942-959c49c571dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091427, "uuid": "ce0359bd-361b-4ae7-9981-67099ada5669", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532d8b19-b807-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762100204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100204, "uuid": "f262157a-07bd-4fed-a540-5b0a9174f8bc", "comment": "Malware payload (Mirai)", "value": "29f6fd9a4feca5c00871b2284feec37e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100204, "uuid": "95d56461-4744-4424-a3eb-d5a4987f044b", "comment": "Malware payload (Mirai)", "value": "1c77cf3da944139b112aa7f96cfb604acc1d0e0d8283c7569aff8ca380d05f0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100204, "uuid": "d0cd572d-8772-4e7f-9168-964cb267da45", "comment": "Malware payload (Mirai)", "value": "56212489999d3982ef26df06d44ddaf98b53a1d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100204, "uuid": "685d7358-05cc-4249-81dc-456e658cb71d", "comment": "Malware payload (Mirai)", "value": "dd84fbe020b5fd313665d0ca356303ad22ed124d24ab6cdb73f2fffe7769d6a8ffa9ebbc2646adb1a6b432bed0f823fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100204, "uuid": "52abece6-81d4-4343-959a-b4cdc4d71294", "value": "T117744C076B8120BEC052C17457EF92A3E733F0BB1121755E778C9A702F57E216B6ABA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100204, "uuid": "546ce04d-cbd2-4fe0-b2be-9b8d54c29dac", "value": "6144:fryELpHq4VOzE0zDHfcm9qA9AJO9ydQb2KiA:fbKDztlPbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100204, "uuid": "7768bc46-bd51-48dc-8aaa-4e51263c3944", "value": 345768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100204, "uuid": "b8a806e6-d7a1-4bc8-84ea-e8b91b3f442d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100204, "uuid": "c81d1aca-7d61-401d-acde-a893640189e2", "value": "2.off3.ru", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a352b3-b7d3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1762077813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762077813, "uuid": "38a90ed7-c6a1-4a75-a997-18501e4840f3", "comment": "Malware payload (Stealc)", "value": "20b6903479682a018b582b20c40dc5ec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762077813, "uuid": "413a8820-3ce2-4b67-9008-65821b8f4090", "comment": "Malware payload (Stealc)", "value": "1e09042c08333f8e61d7c2c13c79360467a7e818fbb775a17eb38b7c39621316", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762077813, "uuid": "98df39b8-70d8-4322-a50e-a760aa9d9585", "comment": "Malware payload (Stealc)", "value": "be65f9629afd6bc45564b9e05f5654f98ae9793d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762077813, "uuid": "db549009-d71c-47fc-a394-d8be86879edc", "comment": "Malware payload (Stealc)", "value": "1f7ff602e002a4d1c318ef67a022750e86ff82607eca3e2f5e90493a73def1c13a43902ba7e26449f7b7aa89c73b57c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762077813, "uuid": "62a13a62-6f5a-4854-866a-9ea7a8d64286", "value": "T14FF50124692FD7C7D481AAB86449039C4E805F29E8A1654FFE7E7E1E76BD1C02C173A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762077813, "uuid": "0c6313a5-d69e-4a33-9008-6fc9633a8005", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762077813, "uuid": "65770025-ba2f-4540-a92a-f566618394de", "value": "49152:U3yi/1tDQN5YnO/woBLt+0St56WmSSP3hacauXDABdHaoazk9gt4NVS1S10+TukX:MJfsN5ZBLwtQ9Rwu4dHa9krVS1J+TukX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762077813, "uuid": "1f13f6c5-71ac-420e-822a-c83a2936cdd4", "value": 3325504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762077813, "uuid": "6621bcbd-1e40-4296-9957-27cb9ec6c5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762077813, "uuid": "d59ea00c-4025-4f66-914c-3ab877d57e61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cda13e9-b807-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762100167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100167, "uuid": "cd417973-2322-41e2-aa74-2f0bf6f4df5c", "comment": "Malware payload", "value": "ad19fbabbe0f229429c7b47f8d2751c5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100167, "uuid": "e4b84ecb-6b88-48d5-a42f-a185106f0d56", "comment": "Malware payload", "value": "1f060315b3021816f0d0675923ea7984c142b33faf89d4b58f0dfd5492d7d67b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100167, "uuid": "9decc1d7-f4da-479d-838d-de41d9d6ec93", "comment": "Malware payload", "value": "799e0798495352faa9a92201b3c4e45824ab93ff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100167, "uuid": "f9eca8ec-0b42-4db2-851f-187072617beb", "comment": "Malware payload", "value": "6f537a9e6e2d2b935211e4fb3053c21e6c4c5d091f871d521b01c1e6fb4090015d0ca7059dd1f49325e2aea59370d7e7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100167, "uuid": "066d29b5-d5ba-4aa4-9c45-e284793341bb", "value": "T19241CE849B5E8FB176C4FE612ABCD84C55F440A91C47B79472A23BF45F05A2234D1F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100167, "uuid": "dad0cb4b-0743-468b-98bb-492d5bc8a922", "value": "24:z6eqzeo5B1WujXmB7hj6bB8/9ABfhTUhThJ2hrBMrFrCIEW//lc81cW4BnpZ:2eOXB8uKNkDNVU1H2VGJWIEq/5MdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100167, "uuid": "d5b88911-d604-4923-b873-0f2792115a9f", "value": 2171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100167, "uuid": "13eb4449-cad0-4067-9e95-bb7bb380c076", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100167, "uuid": "2e3e9503-d4bd-4b14-a336-14fb80785c32", "value": "1.off3.ru", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db27375-b77f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762041676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762041676, "uuid": "6b9c4ad7-af9d-4cf6-90d7-45ba34c03df2", "comment": "Malware payload (Mirai)", "value": "ccd0b161e91aa129be59617af8db6959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762041676, "uuid": "cb87838a-8343-487d-9748-b91aa882daa4", "comment": "Malware payload (Mirai)", "value": "1f8595109af5dcd247e2223ec3e9e73ffd3fbbb66fa9fe078baff602a07629b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762041676, "uuid": "a644c48b-af44-4f08-940d-2788ece5bd0a", "comment": "Malware payload (Mirai)", "value": "2c26a7f5a31cea3aafd47e703147363b52611c79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762041676, "uuid": "1d0fb89a-1695-410b-bc91-55c2c4441ee6", "comment": "Malware payload (Mirai)", "value": "97f36e2d1969423b63357e3a143d35e3624f78ea3fac7d26d650f839b37e7c040094c3d2a17b321628e809402732800f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762041676, "uuid": "5b90db19-84d6-4dd9-a9e3-11427a9f920a", "value": "T15FD33A17B5C180FDC4DAC5B44F9EF53ADD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762041676, "uuid": "686e13d1-1d8a-496b-a8cd-88b64fd771db", "value": "3072:tGtwnNiaOnUTNFiPT9OSQ7AOaogjV2iZlBWCgaiAXQPdL:tGtwnNiaOnUTTuLyCXQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762041676, "uuid": "20ef10b1-e4ed-46af-9842-2aa0a0d1be52", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762041676, "uuid": "accbcda2-814f-44ab-9d38-33259dde1482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762041676, "uuid": "7b0f23d7-1d6f-45e1-a743-6b4d82179d77", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563bea9e-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095055, "uuid": "6003ae46-0b00-4cd2-b09d-880d1f046137", "comment": "Malware payload (Mirai)", "value": "25bedd44882694ebc4834e46c4c830d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095055, "uuid": "35b634ed-3681-4003-af7c-32901f310a8b", "comment": "Malware payload (Mirai)", "value": "20ddadb29d652186d2cc3b43e54ba6f6048f4fa988a7ef0b859ee606ede8d5e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095055, "uuid": "5c1ffafe-3163-418c-9687-6d3bac99b6c4", "comment": "Malware payload (Mirai)", "value": "a422984804b1201c7729bb3ec954d1ed6a14c3d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095055, "uuid": "ac1f0339-883e-45e6-971d-a67a768a50ee", "comment": "Malware payload (Mirai)", "value": "3d1b10b6eaf99eff7fc70d20194ac6f6118a7517492222ae07c8a671502d6f84d45879e2c2835b9905fe53eb890a20d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095055, "uuid": "5dedd505-3fec-4213-8dc1-30a33b0bfc56", "value": "T18C531212C9036875DB23BEBB7AE04FC3F50D8B32B499647A21553158FAF59612C3238B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095055, "uuid": "09ebb4ab-5865-426a-9e21-9ad56ed6542e", "value": "1536:F7XduYshWhq/HIEy6Og3Nwz9hAy2eiuLSM5Tfv83KJGTb6R4d:BdpssMPR9w4y2eJLXTX83K0Tb6Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095055, "uuid": "23307db0-8a61-4518-a5c3-f0dcc37358f4", "value": 61840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095055, "uuid": "2c728eca-d2de-4be1-976f-a1f6003f3881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095055, "uuid": "a7db24ca-8922-40b9-b6b8-436e68b55ddb", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae71caf9-b7e4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762085325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085325, "uuid": "7c74f075-a045-47a6-a9df-284d69c206df", "comment": "Malware payload (Mirai)", "value": "6d88857718b8cdf2b7fef77e0f795c96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085325, "uuid": "b8e3d193-ee02-4375-a53b-1d00b1218534", "comment": "Malware payload (Mirai)", "value": "2104f12036b651e36af8bdbe4ccfbf08de77913ef695978bab61e7fa2380df16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085325, "uuid": "2c9c9c24-cdb9-460c-9ed9-6451ba97033d", "comment": "Malware payload (Mirai)", "value": "c1c97777acf273858c88e8838ac5f9e4887c7bfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085325, "uuid": "0434fa5a-c43a-408e-bf8b-6fb07019cf8a", "comment": "Malware payload (Mirai)", "value": "f59c8781ad8360086e1759867f89379cd02527da3f12d790d8c9dfd73bd671fbc6c8d04a7c807c799003a0c9d5574022", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085325, "uuid": "e6eb210b-b770-47b4-94cc-d81e75ada6b6", "value": "T1C603F2AD444D819ED687063D7F2848DB353ACEA716B2CF1322156687426FB34CF8B762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085325, "uuid": "cabc8417-872b-4fc3-9104-a6e68856f889", "value": "768:eqEqGIIZKTZd6GhOVxiAEuV+8QOekJIDXbUrrKbpRGmrYztGa:exqGMqBfEt8QOwDXbUQQth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762085325, "uuid": "c335c569-d3fb-47c1-895a-702d3c5d2711", "value": 37900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762085325, "uuid": "2a910b3b-677d-40fc-8388-a8cb3408a5b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085325, "uuid": "fc96bb6b-e80d-4abb-93bb-a11c01bc5b63", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2d1602-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072059, "uuid": "097134c3-1a7d-4dc6-bf49-85d955dd9a2a", "comment": "Malware payload (Mirai)", "value": "8baf3fe7ab6b8c0f354da1a128b12815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072059, "uuid": "767a732e-b1f4-486c-b2d0-24284dc6ecb2", "comment": "Malware payload (Mirai)", "value": "21a2e701d3365c8ad3e1c59d78a5db55b19b7f708d516dfe249ba06ce830b485", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072059, "uuid": "4b8a0c6a-3441-4722-b6ca-110b54c29079", "comment": "Malware payload (Mirai)", "value": "2ecb483684a85a25cc4d5c0c081f2299f6aa32d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072059, "uuid": "7a477a91-99d9-4bf7-b581-f53696680be6", "comment": "Malware payload (Mirai)", "value": "a327496b82e281fe077e79e8601c0fae3a620307f6b28138a7de2b7babd6a1854b16c9acb301ee195f2362e3d3ee863e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072059, "uuid": "e538dc34-b302-4799-a71a-b521912bc2b3", "value": "T191631A85FC818E26C5D5027EF92D118E372227E9E2DFB2229E205F603BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072059, "uuid": "f1543606-3b4e-4fc8-b026-ad2a4324c152", "value": "1536:itnVKuUrtVOPksP5VoiVLdml/vDFitm6TkCcKIbina+H0dMc:+0VskgVbzaPKa+H0dMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072059, "uuid": "3658e6c7-5932-44c1-a7b3-b3ada9f3d637", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072059, "uuid": "c0bc8f59-860f-4423-b6a3-b25725e65dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072059, "uuid": "c8e857b7-ca8a-497d-91f6-5795cc7f025f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affdfdd9-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103796, "uuid": "493b4787-8518-42b0-a2a2-f328fe8eac1c", "comment": "Malware payload (Mirai)", "value": "4b137a67edee76b92b6bab4f4dd39cb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103796, "uuid": "1f244d9f-64f4-41cc-b97e-41e55386ff96", "comment": "Malware payload (Mirai)", "value": "2431634e3f9a02485e4188d91137bb3a1d0fb14f95e7090a833d242764fc8e22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103796, "uuid": "69e9d4c6-4db3-489e-81fd-1744bf7e41d9", "comment": "Malware payload (Mirai)", "value": "552275b4a505cc8e40e65e8a887aee5e2180b625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103796, "uuid": "920c91aa-d469-4c3b-8304-6bff28c8a232", "comment": "Malware payload (Mirai)", "value": "ba59c0a5e18f98f77293f2fbe3c26717f4aea8448688630f295bc057df9ece1097c033f9abeabf61fe3227532f0585d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103796, "uuid": "4d83f6d6-6096-4cb0-8f6b-4c10786f2569", "value": "T1C1C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103796, "uuid": "b0b4c053-8468-4ff3-917e-b90d15009eae", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoCrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuICrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103796, "uuid": "06c1189a-ba23-4527-aa4f-ed0e2fc32cc5", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103796, "uuid": "decfb9d4-4710-44bb-ac7e-9b3f736f92e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103796, "uuid": "f5404a35-7dd4-4eb5-86b3-731ee58d6810", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94283604-b7dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762081845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081845, "uuid": "4dd26ac8-5743-4725-a416-603d6aaaee9e", "comment": "Malware payload (Gafgyt)", "value": "becbf726795d6bc6f9116c2569df2d44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081845, "uuid": "4d0777f0-cfc2-4390-8da0-6468bb54df77", "comment": "Malware payload (Gafgyt)", "value": "24d041027fc805b2a992b08591e29ddc908fe7444f3acfb97421ec7972091fc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081845, "uuid": "59805a11-b9bb-4318-b56a-9d31bf9f7a75", "comment": "Malware payload (Gafgyt)", "value": "577771469737ea788ec5e90b5524d15bb3e29def", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081845, "uuid": "79ba2bbe-27ed-412a-85d7-3e439342829f", "comment": "Malware payload (Gafgyt)", "value": "086f4e8aa55c57a0da74f3f5a2ecaf8300e0541579b22953051460cdd769ee2439abdf6f3acd63ccfef708e53bc43b73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081845, "uuid": "17de1179-1f30-4e11-a533-2cecb249908e", "value": "T1BDE32A64F8404767C3D323FAA64D879E7F3557E623CB33116A388DB41FC2B992929960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081845, "uuid": "7efa85e2-11b5-469b-b59d-69ac5047643e", "value": "3072:duj+hJKaeID8M3P/U5hMRaeSIGsmOMDQ4DtsL6Qse:vD8mnU5hwaeBmOMDQ4DtsL6Qse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762081845, "uuid": "a031a55e-0a11-4c8f-ada6-945e4567a6d5", "value": 149011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762081845, "uuid": "f40e64ec-776a-4cc1-b986-d960126f85a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081845, "uuid": "dd22e3dc-e49f-450d-94dc-a85e688ec784", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b8608b-b7e1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762084126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084126, "uuid": "236d7b6a-02d3-48b8-91f7-57099bddf2f5", "comment": "Malware payload (Mirai)", "value": "0f8ea09b9af9ab95bca0690f6687d30d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084126, "uuid": "68afd607-ddb5-4e2b-9505-5ca3256743db", "comment": "Malware payload (Mirai)", "value": "281a1e9eea33fee84476d5dd0b0de3c27a9ccc94e62b006f0b1f6ac89e1e4ccd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084126, "uuid": "c10e88fa-e19d-40bd-b4ef-6624fbb04f07", "comment": "Malware payload (Mirai)", "value": "d560acabab3e654e3114a925b1bf4b1df55dec91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084126, "uuid": "31a14e89-e3ed-48fa-afb7-dcc655f97967", "comment": "Malware payload (Mirai)", "value": "bbe9e817e2af4511b1b1ce7f42059e50f483601eff7da3019da2fbbe2f62ca27c1c09649f2f3b01b97a5b346eeba077c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084126, "uuid": "621dca18-e808-42eb-949b-7f05a850265e", "value": "T1BBC3AEAB760B4810C86146F11BD79FCE3F6372428E4BC9F72D0D667B28795CB1946B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084126, "uuid": "4729cc4b-bd16-4822-b9ba-ee6f3111f092", "value": "1536:SGWeu5qpFGNGTc8+4msO73MSQuUV8OZkiHaVXMElVXVFaUMxNqAgin3/LWU:6h5qWNv45SQZV7aFVXME7VFaUQgin3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762084126, "uuid": "e1492e5b-a9cc-458b-9fd5-053a63c29a05", "value": 124280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762084126, "uuid": "2879bd97-5757-40df-b871-22842ccb5b41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084126, "uuid": "e173b8e3-65e8-495b-ac07-a722c96364be", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4926c490-b7f6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762092886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092886, "uuid": "df6dc940-4961-4294-928b-3169e9f1c8c6", "comment": "Malware payload (Mirai)", "value": "292c292511e62a1dd610837ecebc4e6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092886, "uuid": "862395ef-5c6f-4e91-8699-c99ed3654b5c", "comment": "Malware payload (Mirai)", "value": "2820225b1594d51702e6979df93ab90998f316ba60ba9d43d2434b43274a03ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092886, "uuid": "45849023-9f7a-4e35-863e-92eda1e60004", "comment": "Malware payload (Mirai)", "value": "6f51e06587a7af7d09404fa365ffcf3ae7b87373", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092886, "uuid": "14cbecfa-8aa9-44f4-955e-248ab07dc1d9", "comment": "Malware payload (Mirai)", "value": "b26b9806eb2eb18de9761fe0222df167d5c1f5a53b5e17ce9a2e714567c2e4b3ca27642718ae27518d41427cb9f76614", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092886, "uuid": "2b55731b-a974-4705-a932-b01cf134ab34", "value": "T1CF734BD9F801DD7DF80EEBBA4453090AF770676146C30F3A26ABBC5799311A90967F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092886, "uuid": "eebf6056-3203-44d1-94f0-59cdb12ba5a9", "value": "1536:d8LUhpLaViJrMZpCwWmo8ikyE2+VzTKae6u2nPhd1dnVM:d+YpLaVilUpCwWmByE2+MaPBTnVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762092886, "uuid": "66cd7728-d513-41cf-860c-f425d4152d0b", "value": 76460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762092886, "uuid": "f0f2c3d8-0d3d-47bb-9882-32418d0b33bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092886, "uuid": "e5224541-0d5c-4a5b-887c-5da60711dda0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1ea699-b7f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762091198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091198, "uuid": "70674dd1-f88a-4f09-9197-602d7ea5420c", "comment": "Malware payload (Rhadamanthys)", "value": "914b5ff7c76a23cf73821b6c1c5ae86e", "object_relation": "md5", "Tag": [ { "name": "217-156-67-140", "colour": "#E2F216", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3431", "colour": "#8DF481", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091198, "uuid": "0b161209-9edf-4a66-8a27-b2e585ce9d81", "comment": "Malware payload (Rhadamanthys)", "value": "2833744a5220a796a0ae5f91fe7c6976179885494ff7f35220b0a93561d104ca", "object_relation": "sha256", "Tag": [ { "name": "217-156-67-140", "colour": "#E2F216", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3431", "colour": "#8DF481", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091198, "uuid": "ff815afa-d22c-438c-b4f2-7adc01c37dc4", "comment": "Malware payload (Rhadamanthys)", "value": "b7a1ef1c05adcb7a1debb3c55cb35e8d224542e5", "object_relation": "sha1", "Tag": [ { "name": "217-156-67-140", "colour": "#E2F216", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3431", "colour": "#8DF481", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091198, "uuid": "d8d1fd33-e40b-4cbf-9f92-5e3fc2dbad18", "comment": "Malware payload (Rhadamanthys)", "value": "0dc385ee1e0f4c3061c5d331371ecef576847333e06f51c3ca33aca0fa2960cf1ce63373a27e10de97207cbe32972d9c", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-67-140", "colour": "#E2F216", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3431", "colour": "#8DF481", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091198, "uuid": "a1a490ee-535b-43fc-a9e6-7ca3ba34bf05", "value": "T1CE0633842EBB3A55AC71540DC560F76194C43B32191E672018260BBE7AFBFFA0E7A15F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091198, "uuid": "7d15b205-f9cd-4c7d-b5fb-ed4df158c103", "value": "98304:/PXMUaOQBtW9KsGmMtzLtY8enko+fPex++UtGpX9QEwvGc7Kh:XXM9tuKiMt92koyyEg9Qhec7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091198, "uuid": "aa940f0b-9263-4c68-885b-8d72988b606d", "value": 3921555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091198, "uuid": "e933dc17-72d1-47ac-b04d-5479b5a93b93", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091198, "uuid": "e0b45742-7e7e-4251-a527-d81a2103dd5a", "value": "adobe_premiere_pro_2024_v24.6.1_(x64)_ _fix.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac24e2aa-b7f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762091334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091334, "uuid": "a9f45030-96dd-4523-95ef-a7070132bc70", "comment": "Malware payload (Rhadamanthys)", "value": "6c0af02f1d2fb03ec479ccfc9cf30f48", "object_relation": "md5", "Tag": [ { "name": "64-188-91-232", "colour": "#443B2E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091334, "uuid": "7abf32c8-b0de-4234-bd6a-312393887a12", "comment": "Malware payload (Rhadamanthys)", "value": "285403b51c4897c5aa8ff01c2d5d13d018381454b69b07c6a5bd92312091e1d5", "object_relation": "sha256", "Tag": [ { "name": "64-188-91-232", "colour": "#443B2E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091334, "uuid": "50e1b268-203f-42e5-948b-1757b5a6222e", "comment": "Malware payload (Rhadamanthys)", "value": "33a5881e85f416e0971efadb53b4733756c700d1", "object_relation": "sha1", "Tag": [ { "name": "64-188-91-232", "colour": "#443B2E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091334, "uuid": "ffe219d3-7ba5-4aff-b940-8260192611ff", "comment": "Malware payload (Rhadamanthys)", "value": "cbb5eee432d5e86acbed85892b88555e0738d1e69f93285162ea8400f62f50f2e3aa8e19318b9fc1a2598de8bb9c9ecf", "object_relation": "sha3-384", "Tag": [ { "name": "64-188-91-232", "colour": "#443B2E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091334, "uuid": "4b75a81b-88ce-4c22-8f96-e5851a926900", "value": "T1AA75231E53F07865D5BC237482F5818397727CA21B9431EF67C4A7EE0F62AC0AA34786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091334, "uuid": "dfb70a5d-1d01-406c-85d6-60671896aa87", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091334, "uuid": "31f83d33-d4b4-4ea7-bad5-bab8c926999a", "value": "49152:Xj3lwMwliSTFBtR961od+pa5dXdKmmbg:7OriSTJ61Y8a5dNKlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091334, "uuid": "9ff4fec8-6d58-44b7-9f8f-ce6acbb62f97", "value": 1642496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091334, "uuid": "ffb0153b-a188-4673-ba6e-1292a791c61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091334, "uuid": "81a883b3-bc85-46eb-b170-de2088e28bb2", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871e3723-b807-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762100291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100291, "uuid": "dc0820a6-3cac-4de8-bc7e-cb50b21e5f98", "comment": "Malware payload", "value": "94b4d9661ed828dd98ea649b7642903e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100291, "uuid": "603998e5-9d4a-412f-8887-c6232542b742", "comment": "Malware payload", "value": "289510dd049a4e5c6dbe146d858ffbafdb53b2d0aa91f229b449ab7341af1b71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100291, "uuid": "c203e9a8-64fb-49a0-80f6-8789f85f4059", "comment": "Malware payload", "value": "d98416ce360c7ab134a60ed19c27621951a8f341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100291, "uuid": "6888944a-b694-45c5-adc8-ca457c24f310", "comment": "Malware payload", "value": "1e5ac228b54b352379476f542380fd4a27db49e9e51c6b3a1761af8037f902b7d1b6e2edfa2304cbe09ee1a220938b65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100291, "uuid": "62e17f4b-ab3f-4a60-9305-9c3d52b33403", "value": "T182836CC1DA43F4F8ED2515B014BBA7698E7AE436113DDA85DBE52A32DC12F00DA1B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100291, "uuid": "ca9eb80c-3bec-48b5-bec7-35caf219d34e", "value": "1536:Snl9eeXW8OBADYRDIcOJTHo753bxFXIkrGsC3:Sl9eeXWri7ot3txIXV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100291, "uuid": "ad92559a-22d8-4c18-87d8-f340ef401f34", "value": 83212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100291, "uuid": "c4867559-9eba-4d91-9788-3ef3407b1e45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100291, "uuid": "b372594a-cf3e-4093-a460-447e52ca8c69", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20289dda-b7d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762079932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762079932, "uuid": "8bf5f4c0-ce79-4441-bb39-857c6e8f8cf0", "comment": "Malware payload (Mirai)", "value": "68decce8bb2fe1ed4bc77667f6e0dbc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762079932, "uuid": "2855391c-0ec9-48b5-b953-5deaf2331154", "comment": "Malware payload (Mirai)", "value": "2c60a43d464d4347c406cc515e6fb9ded6f5549029ccac7d57c0a851d6ec39b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762079932, "uuid": "59e7214d-db21-4786-aa37-2843f6458cc9", "comment": "Malware payload (Mirai)", "value": "a2a77b68726136ba618f86bc51fd302acf6c6d99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762079932, "uuid": "b753c218-5c75-4d7f-b3b1-401d2e4d77d6", "comment": "Malware payload (Mirai)", "value": "193a4019cd67d85ddae6ffa1eb1be06b63e62ae3fac4f12166b0aaf4b1757aed649d1a1d3dbfe7e28e9a7d029a5a2b20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762079932, "uuid": "96329704-6ecb-43de-9ce3-e69a254a0527", "value": "T1A2A2D0F4D18419E5E7AA7DF278EAD9D833324F8B6F26DAD1A441F38239034D781164E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762079932, "uuid": "925e68fa-c4b5-4ce6-8bc3-b3ae86f292ca", "value": "384:YFM3yaKlKfiIlZPMBFFQbFcXjnA+NT34n6ozTb0Bai+szyetncM4uVcqgw05VxJC:rCaKl+RjEjQBsAaL4n6hBaiVzdD4uVcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762079932, "uuid": "77f30ad4-f565-4289-b477-b8da05b42b27", "value": 22928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762079932, "uuid": "df57bfe8-102d-40eb-8981-ca66da1c27cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762079932, "uuid": "701c0d74-55c5-4b55-ad16-6b60781d28db", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9467acc-b7eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762088457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088457, "uuid": "224a6459-8e16-4e1d-8f9c-7e6b5f20918f", "comment": "Malware payload (Mirai)", "value": "f3bb5cf76ae733a247de2533bbfff4c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088457, "uuid": "6d4c3dac-4d97-47e6-8ecc-8d16e61b3f6d", "comment": "Malware payload (Mirai)", "value": "2ca219d6ecbf3a884227c861106110e2ce4b9ae40fc55a41efe35d4573ccff7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088457, "uuid": "a47548c0-9c1a-466e-b26a-a670b342e5ac", "comment": "Malware payload (Mirai)", "value": "e1308c73573a84fd706c81957c43d68fd3d06372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088457, "uuid": "0b52774c-f911-4a4d-8e1a-f3c7c8ebdc7b", "comment": "Malware payload (Mirai)", "value": "316a3bf44fbedd571cfa6937b018fe7f7ec65aa324432a9e73ed292a23b1a2c60be37a6c5416cc298928d47c19cb89f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088457, "uuid": "784be29c-07bf-4833-8e95-f85529899234", "value": "T12CC30906A9819F16D4D622FAFA9F418933136FB8D3FA7101DD206F64278A9DB0F77112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088457, "uuid": "18984cfa-2000-4709-a2a3-a059d261ee04", "value": "3072:OhyzEaNxFXNxZgLaqxrDwXns9cmt3tXGSUv13:OhyBFX3aLaqxrDwXn0cutWSUv13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762088457, "uuid": "f7f2bd97-2c41-495e-ab58-ebb984fa6fb0", "value": 120168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762088457, "uuid": "7dd82de1-def3-4867-806c-2d4245516746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088457, "uuid": "7f99fb09-5a60-43f8-8ca3-6e0711130feb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3bac5a-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095175, "uuid": "32b81629-a124-4b5b-a326-595d534ec822", "comment": "Malware payload (Mirai)", "value": "47d8418968d03132341ca557c2083f59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095175, "uuid": "38a0e513-a7a9-47f4-bad6-6dc353df7bcc", "comment": "Malware payload (Mirai)", "value": "2cebdcedb6a2980ded869e2f785620980aafbd823ee3bc830151ab2e50d4825b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095175, "uuid": "a775b388-2a83-4263-9ba1-9f25c13c6cda", "comment": "Malware payload (Mirai)", "value": "1ddbb0225764a460d32b3552efa094bfd7461fa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095175, "uuid": "345095ee-2cb2-4231-98b1-543a432b50b3", "comment": "Malware payload (Mirai)", "value": "6952e641a33b99a96f6c8b6ca9511c1466d7a9fd2d314745b97757000a16ed352f609b4e6f9284867555b81807a52641", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095175, "uuid": "402ac444-b199-4fbf-be9b-245e332a8c4a", "value": "T143633BC9F983D4B6E857093010BBBF639DB3DABE2168DA43C3B855369D12502F416E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095175, "uuid": "315d0108-18f6-49f3-acea-1d49ce4d0a09", "value": "1536:ltWizyA04PfWjF7lOvZOWsIyq3XkZSYK:ltFyA04HWBJOvwfIyqsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095175, "uuid": "85fb8705-8f08-4d5b-887e-e8881436c153", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095175, "uuid": "bbfee437-5c51-4984-b7fe-93679da7c901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095175, "uuid": "1344ac61-2956-4ba5-9fb9-a496059a6981", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3798e600-b7f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762091139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091139, "uuid": "e47c0aea-e9b8-4690-b4b0-05558bff3d11", "comment": "Malware payload (ACRStealer)", "value": "4f649e502b69f84bf103de894103ed18", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-1025", "colour": "#352F13", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091139, "uuid": "38748aad-251f-4e07-88ea-d1a3e8a52c3b", "comment": "Malware payload (ACRStealer)", "value": "2d2d0da6585eb4cdd1d6eb33e0de36229bd23cfc865171792564070db078c15e", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-1025", "colour": "#352F13", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091139, "uuid": "bead9d2e-ed46-43d2-92ad-1bd312c0ecf1", "comment": "Malware payload (ACRStealer)", "value": "22aec29d4d44782e0ce7cfb4161ff5a5b447b71f", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-1025", "colour": "#352F13", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091139, "uuid": "c8de57bc-d26d-48d5-9ec3-dcb4c66889b0", "comment": "Malware payload (ACRStealer)", "value": "4e4fe3d7b6ab6469d1961004e5631d11cf3df5bb53a4d382cc91a0f174b1f9dba30da050bbfb39ea929a4ceb72240ad7", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-1025", "colour": "#352F13", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091139, "uuid": "ea390415-b256-4016-82e8-988479f992ce", "value": "T19A0733C9FFE2D454EF20F6B9B610DD573802599BADCB2C5126A820577A7EC06242F0ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091139, "uuid": "081c9a82-92f2-49e8-a8b7-daae59c22d3b", "value": "393216:luRVtUOlVVpOt5cPfp4xUorw8p0+eAUYTaRhQ0yIjLv:4LtUkEItoMIdyQ0yI3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091139, "uuid": "e0735342-2999-4fd4-97db-93efb1ef900c", "value": 17567440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091139, "uuid": "c2f7c044-b2f4-4b34-bc04-6640f115cb52", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091139, "uuid": "1b0195f6-630a-4999-ac84-d4a54a19ef99", "value": "\u00ab\u00bb\ud835\ude88\ud835\ude9e\ud835\ude9b\ud835\ude9c\ud835\ude75\ud835\ude92\ud835\ude95\ud835\ude8e\ud835\ude81\ud835\ude8e\ud835\ude8a\ud835\ude8d\ud835\udea2d\ud835\ude98\ud835\ude86\ud835\ude97\ud835\ude95\u00d6\ud835\ude9b\ud835\ude8d\ud835\ude78\u015c\u00ab\u00ab1025\u00bb\u00bb.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66bde48-b7f7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762093606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093606, "uuid": "b72c067a-5686-4d7a-b39b-7c5e3f85450a", "comment": "Malware payload (Mirai)", "value": "3112abe0383d719b20a7e07dc2a1e989", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093606, "uuid": "fac4ad5b-d753-49f9-9783-996330e30d09", "comment": "Malware payload (Mirai)", "value": "3574acd0fee0140c398f7b8d26cc95d8ae39c1d42f601a075937ae13d8dec69b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093606, "uuid": "0d0372e0-9900-452d-9377-f2e78e14b061", "comment": "Malware payload (Mirai)", "value": "3dc8c4d9aadc889655c811d71212583a25be42fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093606, "uuid": "8acf9d43-094b-4c06-bcc6-4d7aeb521535", "comment": "Malware payload (Mirai)", "value": "1442fa143bee2fe9f0f66abf38df59574cefb201d27458ee834dceaa37189b170e4dc5e4529b5a3ba76d44294b56a568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093606, "uuid": "8ef081a3-7086-46c9-8df8-33d9916a8869", "value": "T18FD3960E3E218F7EF769C23447F74E21A35923D523E1C685D2ACD9150E6438E685FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093606, "uuid": "74e77d68-fd7b-4809-b526-0dc5e17e866d", "value": "3072:yp4eAAMQWdBLRtR9gWYhxdePrZd6gDrIJnWnzf9q:yp4fjTBIWpvjvU6f9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762093606, "uuid": "ff7f477f-9482-4414-aa3b-a91f36b84dbc", "value": 138588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762093606, "uuid": "c9d49b87-2bdc-451f-9a2f-3bf801aa7a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093606, "uuid": "a982de7f-d45f-4813-a765-c919046ce99b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f585cd-b7ec-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762088685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088685, "uuid": "ec724390-39df-421d-a429-0f03fc6a62f2", "comment": "Malware payload", "value": "e0d72fba4e5e194e20d7be95d6efc0a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088685, "uuid": "64e33ed0-42a0-4260-8493-ea341c5d27db", "comment": "Malware payload", "value": "36bfbac6f3fdc42995a176a18254b236830a67f865d573bc2f6ab020592fbab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088685, "uuid": "2b4dd3f6-8fd4-4ff1-8dcd-498f021ded83", "comment": "Malware payload", "value": "3fde5105494b2b5df51962a489fcbded06a7c04c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088685, "uuid": "19ca3f31-2373-41cf-b7a2-e020bcea5df4", "comment": "Malware payload", "value": "fb83c9c5fc4fa89b0cb1b350207775809e13d4f2ebb8136f5a4bc206f78f3db8ab9604200ca655579f175f7dd9db7c75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088685, "uuid": "d341e2f0-f90a-4c0c-b353-b567c8ff7a10", "value": "T10D24648ABFA03FFFD81ECD330295CA09129D491A5298AF762A34D518B65B10E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088685, "uuid": "cadc561a-838a-4c04-8a70-2834a9a2dcf2", "value": "1536:hlpYmWJx9oryeNYh4VbJrw9J0YavbDrOP41COKbq6/BgJ5F0ElLnzYjrRbd:hlVkxCryKfwz0Y2CdvBgJZnzer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762088685, "uuid": "2ddf4217-1cd3-41a4-a15c-e3f43d5f2b48", "value": 221628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762088685, "uuid": "c80ea870-bf22-4d4f-bf36-6a88ff2b02ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088685, "uuid": "dde68fc6-afb9-41b2-b4fc-667b0d0ead3c", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5b4a59-b7a6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762058669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762058669, "uuid": "9a1ac524-0a05-43d8-90d2-2688eea1c73a", "comment": "Malware payload (Mirai)", "value": "ed686860b254cb5b595f64408ed4a02b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762058669, "uuid": "e76e16a8-9c1f-4b30-a96e-ff25ee9a83b7", "comment": "Malware payload (Mirai)", "value": "36c3eba9ba82171c7f2aa9900e6af9e7dddfb9e177b1d757f27eea84eaabe48d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762058669, "uuid": "b5a55ca8-b040-4d16-8a48-cfdbd09b5cb2", "comment": "Malware payload (Mirai)", "value": "5c1fc3691d7a71f366af23c9c50834700c67cd5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762058669, "uuid": "4c923c45-2ef7-42cd-8f1c-4e1f0123bc49", "comment": "Malware payload (Mirai)", "value": "fdf2ad9bdc6ad7dbab739e9127911610910622b2cff65d60233c607e890dab13c6b0b9a3cacd35f4683535e188b4ac73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762058669, "uuid": "49a51594-c9e7-4d30-8d9e-f22e115c2a01", "value": "T148734BD9F801DD7DF84FE7BA8453051AB330676162C30F3E269BBD57A8311A549A3E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762058669, "uuid": "14efdcb0-b7d2-4cb1-9256-a1c9f80c4675", "value": "1536:Zjeyh0HV+sXOHupX5+uOQQ8iRyd0sjkflJSjQJjTHR+zwiv:ZP0HV+seOpJ+uOQcyd0sgJOIKwiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762058669, "uuid": "fb8d8d8b-3478-4988-a81b-db33a1517ee7", "value": 75500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762058669, "uuid": "47576682-af08-4124-8a20-1bc632dc90d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762058669, "uuid": "ee7144a0-8984-4c81-b24a-dae6b5ab8d46", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67696c00-b7a9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762059866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059866, "uuid": "f57dcf8c-3410-46d6-8f91-a4281a4c7218", "comment": "Malware payload (Mirai)", "value": "64e5dd76e4f795dcd884a0e74c9041e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059866, "uuid": "479d9f6b-8406-4cfa-853b-dd23f6f50561", "comment": "Malware payload (Mirai)", "value": "371adcb692a4e0121a5482d1a19eb8bd9d284ac3d9fbe07985e1602ab2588491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059866, "uuid": "a301c71d-fe37-4352-9a15-e2d3921cd358", "comment": "Malware payload (Mirai)", "value": "c9ee06f0d70ce59551a29983f64d7e6458309f97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059866, "uuid": "c5fb2932-52ab-4370-91b7-616dc27ad236", "comment": "Malware payload (Mirai)", "value": "40ae27dce004d1d12c46db5f3bcd13d487c275fb2e00ae44d13672d87ffe64f396afbd48a8736c215d3a1bd3da5dd85d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059866, "uuid": "19ee6f54-e2c0-4f27-87f7-5285d4dd8a16", "value": "T1AEF2E1A5D3B4D271D1A6F03A2B048DC4A15B0C84CAF843E796E328C69937C35B7B66D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059866, "uuid": "a404cb83-6e5e-4acf-8704-6282ccc17d86", "value": "768:7A6dzqnk6HLeEXFNsydR5DUq8ytn/TKQi/7gQzripdBmAnGwHECZKpdZx:7pqkiLvjsydRVUwb2/UQWmAGgTZKnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762059866, "uuid": "4ef3d194-ca90-4866-ae14-fe933008aa13", "value": 35372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762059866, "uuid": "db5c728e-5d9c-42f0-aa93-4b1634653f1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059866, "uuid": "4bc8a2f1-6a6c-4e85-962c-f958636af073", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a6d93d-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074284, "uuid": "f0182dff-0aee-488b-8135-447c22a00002", "comment": "Malware payload (Mirai)", "value": "cd61cb7e4f52c95ecbac2bbe683544f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074284, "uuid": "2a0b5461-fd85-4ed4-9e20-4f19a5d114af", "comment": "Malware payload (Mirai)", "value": "3949f323711c8cbacc347888df6ffac9286f9573c145a3d190aae4bd5132a49d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074284, "uuid": "5a90e5ce-3a00-4f5e-b50e-54282fae500c", "comment": "Malware payload (Mirai)", "value": "387323a6b9f661dc82644cf93f7186dbceea25fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074284, "uuid": "e0f2bd75-f26c-48ac-a0f3-2b669f325e47", "comment": "Malware payload (Mirai)", "value": "e110fe1ceb909bec9f47bf0f398d65fc09b9498d24d97695c595bd6bf0cf589dae44b32801906a80a3213ad453bad9b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074284, "uuid": "7d90c2dd-2b7a-44ba-a177-24b00324d762", "value": "T16F834B02B31C0A47C0A31DB03A3F27D097BFA6D121E4B689691EAB969675D332546FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074284, "uuid": "a775b009-dc89-4b03-8a55-2c7519ee6de4", "value": "1536:5/TMHNXs1EToVgTtPrLEdk3ogjXw41/PfVMH+MY8boqn4+iauKe08b9ubc:F4u1E/TqdyjNY5Oq4+9qoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074284, "uuid": "200e5031-205b-4646-8417-ed4d7029c974", "value": 87992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074284, "uuid": "f8270dbf-43ca-4d56-a289-12ba7306fb36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074284, "uuid": "962af4f6-95c5-4f2a-b9a0-59e40129ce04", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb38663f-b845-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762127008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127008, "uuid": "8b5e7cc5-d2eb-4385-8bdf-190b6eb6ceef", "comment": "Malware payload", "value": "c82c97f852b2eca8ab9ba3ccbae5b853", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127008, "uuid": "6c2f5b66-a7bb-4814-b97b-e6f2471309ce", "comment": "Malware payload", "value": "39679d3638e1379244a9fa70a4e3c187249eeb4950dce9cd350a57c8cf328207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127008, "uuid": "dddde945-7fe1-4703-bbf5-db4d2181fe09", "comment": "Malware payload", "value": "0b1645872e222f7b1dfade68f9a67ec17527cccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127008, "uuid": "3e6ea7eb-2d28-4440-9503-0bfe629e4e06", "comment": "Malware payload", "value": "5b67b6dcdd51d111645c3a16e6191295be41d9396016d4822d43be6354fdc2c219cc2873fba54d1a1d9023902eb86b6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127008, "uuid": "aae5813f-de8c-468b-9422-239ff351e12c", "value": "T1CEC2E1FCF8F8B486CD6CDD3EE26D19E18DA5B0D5539B8787A3040D416A1785BE0071B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127008, "uuid": "c300536c-f597-434e-a635-628446346c9c", "value": "768:LgO7N1/LCHsd4T3TlS5ptY+eqnX/X6rv5nWl:x7N1TCMduS5DY+RX8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762127008, "uuid": "5fab8676-b980-4a9d-a6fb-f70c58d0a2b7", "value": 27532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762127008, "uuid": "25ff0e4b-32fc-469f-b4dd-7fe97a236de3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127008, "uuid": "d17b4bd1-23cc-41e2-aece-87b0aa422b8c", "value": "wewe3.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3ba41c-b7b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762065110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065110, "uuid": "147f867b-32a1-4bea-bd80-7424f99294f8", "comment": "Malware payload (Mirai)", "value": "00636891fa94067c29a3aec987eafa53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065110, "uuid": "e24f4f2b-c06b-465d-983e-d31e8f65f787", "comment": "Malware payload (Mirai)", "value": "3bdb1a3f45b283a583fe98bc70a6870004216abd3e198bd5fd7ccedeadddbb98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065110, "uuid": "a5a19804-46b1-4b51-8f4f-ee8a0d8e2ea6", "comment": "Malware payload (Mirai)", "value": "8352b072c8b42e3457aa89a09667c5ea52889cb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065110, "uuid": "b0ab2122-12b3-413b-b8c9-50fb3c02431d", "comment": "Malware payload (Mirai)", "value": "052bd47a38970f07516a79fbb5eb1d3ea35af9ed94800514eeb7bfb2813a7007018c7f59275af82710d67e34c47ce111", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065110, "uuid": "4f1b5717-600f-4596-bb6b-50ab676c23d0", "value": "T1E8631990BD81AA22C2E12372FB6E418E371553A8D2DF7307CD226F247BC695B0E67711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065110, "uuid": "872b5bc9-65ab-4b7a-87a2-64d3a21d1f01", "value": "1536:uSj8xtoKwjsFe/7N5P/jdfmf3Oh9O3tbyTSicb1pOsys4AhvqUSH:uSooKsso/7zbpAeh4uTStJvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762065110, "uuid": "496c451c-7b4d-49c4-a54d-e1dd7d6e89b2", "value": 70792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762065110, "uuid": "5a867fe9-62f6-4bd7-b992-aaaa99286faf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065110, "uuid": "3d071e37-c7c9-4805-a47b-997c7a4a58c4", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7974be-b7f4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762092058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092058, "uuid": "783df982-01eb-4eab-8c84-b5f4509ca0f8", "comment": "Malware payload", "value": "1ffece7d14659a3828741bce174ba393", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092058, "uuid": "79bcd70f-9adb-4745-b16e-ff3991d90fdf", "comment": "Malware payload", "value": "3c1d7dcbdcacea769d5c84323b51e64261c386edcb580e2965f9373de763ad0e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092058, "uuid": "afeb083a-4422-4ca8-9938-7fc55393ee91", "comment": "Malware payload", "value": "c5bdb511daab76da7f7cd4b4b8bdae9e9d257258", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092058, "uuid": "7025fb05-fb6c-4434-9528-3fc9d0bdc2dd", "comment": "Malware payload", "value": "2eec641840260e40ac1eb1101a42aecc1a047134762248005a65bd58c275b22813885dbed6303d181f0ee08456dfe537", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092058, "uuid": "d74621fa-45d8-484a-9c1a-4450497d0dea", "value": "T16EC08CA2453CE4B1923A0A5EB261F2F89906A8280FA138B1D4188744A6740741C8FB3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092058, "uuid": "aa5d06a5-0a9c-4e50-901c-bfd7323d73ef", "value": "3:pKWNFLIx8sv3uy9Fb+dNMf81hhMitUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfEMhebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762092058, "uuid": "94aca74a-78d8-4486-8235-bca13d067e6f", "value": 166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762092058, "uuid": "5a62e303-2cdc-4ba1-8c94-1159a9004f6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092058, "uuid": "7877ddde-91dd-432d-96f0-553a0db7c919", "value": "q20r9we87e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23867b0-b841-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762125382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762125382, "uuid": "8cb60574-4e9a-4674-8d56-2e779e25bd8a", "comment": "Malware payload", "value": "266e4e172606f39c36b59bdcfb57f526", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762125382, "uuid": "eef5e511-3c4f-4902-adde-adb21ac25db9", "comment": "Malware payload", "value": "3e4f9a5425c81fa0ee03e8edbccad2fdbf09a7d053d55fb21b06d1d3022128b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762125382, "uuid": "c62d128c-caf3-49b0-a345-614c9f3e16cf", "comment": "Malware payload", "value": "9358e621932b3efe04e9b9e1d77eb12f7174025f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762125382, "uuid": "c70de21e-0d1b-402f-9b89-afaf6915cd70", "comment": "Malware payload", "value": "9f586acf730e4c6961f7e9787dae81298f9b6aed8873b12b51e9c095633c1415ed4e12b95de8a732315de30e129f110e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762125382, "uuid": "89db93bc-e7f7-4303-84e0-88b27b5fb8b4", "value": "T1C9E0C299FC520836B8798CBAB7DB2451951FA20B6E06948B318B520AAAE5A60B060493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762125382, "uuid": "000ab833-48f6-4f69-8959-518c929c2e72", "value": "6:hftJ+pUKUF2RVYrV/jkOYf53IoXt3FoF/fkVKhOXqIKXD73IKX+N1IEWYq1IKBKW:ZtJ+jRaV7Y90F0ghsOTh4WYO8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762125382, "uuid": "0c9e9200-8fb4-418a-ba95-3b7edec93770", "value": 301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762125382, "uuid": "b2c8c647-fedd-4a9a-bcc7-9a6958341a43", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762125382, "uuid": "5187591c-5983-423a-bef2-5fa5479ea3ec", "value": "res", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfcd97f-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103789, "uuid": "23e4c2d3-529b-47e6-b6ba-fd525e2dd64c", "comment": "Malware payload (Mirai)", "value": "7b561bb513c3144b52490eefa0fdf181", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103789, "uuid": "a6a21930-84e2-4296-a804-fcac323aa0d9", "comment": "Malware payload (Mirai)", "value": "4218c508da48b45204b4c2127f108f928cf34500fa00f9435b8dcb6c287fd007", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103789, "uuid": "4aabe3ff-634c-4543-962a-33843f9c8018", "comment": "Malware payload (Mirai)", "value": "da0ed0886c6a61c6093b822153b14bea4d0ebc98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103789, "uuid": "ff4f1c6d-18fd-4b32-a7c1-8c762d050cea", "comment": "Malware payload (Mirai)", "value": "242df7b634965e6e2b9089f4d34ad63d022ba436c41b335cff1b6e7e0ed0f6f9aac54ba2b541cab626035d1d5a0f4cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103789, "uuid": "02d8c561-8a13-4ba7-b700-7a9841e99fc6", "value": "T1C733F707F84285FDC556C13417BABA3AE83671EE533CB6A777E4BB222842E614D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103789, "uuid": "79c76176-5c30-47e8-924e-40adcf7fa655", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1HnJYC0QkiuVn4P:yHlPZMEcTFZ2A1HnJp0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103789, "uuid": "494795df-0e6c-4276-8451-389e6b82213e", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103789, "uuid": "1fa67d2d-1cdf-4c13-b3fb-c7565ce8c9f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103789, "uuid": "85d7fa63-7b55-4d32-a7a5-67c93494a43f", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7345e72e-b77f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762041847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762041847, "uuid": "fafb1fed-fb46-4c85-9ae4-79eecd808e2a", "comment": "Malware payload", "value": "f1fb2865b8e42f4e50394581b3b16ad4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762041847, "uuid": "9a67f657-b785-455f-85b2-2d71b89988ce", "comment": "Malware payload", "value": "432d94b1b8eead34cc1f3dd63648c24f4588b5f55309176b049ce99eea1a5c7a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762041847, "uuid": "370552bc-03bd-4180-b44f-5fd0060b18d3", "comment": "Malware payload", "value": "288f0b8f8b100b25b5157f7a05dfac21a4ca03c0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762041847, "uuid": "a70793c6-98dc-4829-8677-a68c7e04cfee", "comment": "Malware payload", "value": "06c6d6f0455ac658531ea2f6445f8fcec0b6f97c1bdd980fac0575166bf65cdbdece9d84fcaddf3f6ab50f108c728e48", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762041847, "uuid": "8b8392ad-37d7-48ef-965b-8c02285c10a8", "value": "T1A6C08CA1843DD07153390A5EB347F2F8E903A4280BA038A1D4188680A1740701C4F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762041847, "uuid": "b741143d-266b-4cc9-a1a4-2d62816cdebd", "value": "3:pKWNFLIx8sv3uy9Fb+dNMf+fNc1QREtUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMf+lqQhebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762041847, "uuid": "1c40928d-2880-4169-9d40-0ae53881777b", "value": 168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762041847, "uuid": "c0f83666-6bcf-4740-82cb-84124118dd9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762041847, "uuid": "089c017b-ca10-4d47-b3ff-530b4f647d56", "value": "gnsnnx8oez.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4845821c-b7ff-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762096750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096750, "uuid": "04685b63-4b52-4258-8c22-e608deb2f137", "comment": "Malware payload", "value": "65b77a26121e757a7c5037418794ebfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096750, "uuid": "bdf9122e-2c28-4fa6-9921-00b48ddef69a", "comment": "Malware payload", "value": "446c7fafb49251c34a38778e669821572ba7ed448fcac4838a95922c2bb04a90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096750, "uuid": "0e7cccc8-6677-45b3-b81e-b02a3e339a4f", "comment": "Malware payload", "value": "9e90b3c6658d1bcf5237d4f96b6db46aff948428", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096750, "uuid": "b1910ede-8c9a-4655-a689-331080ed8a8b", "comment": "Malware payload", "value": "052216436eab8e8170e6bf6586622d3213bacfc1f85ad2630027e056fb3ff85c449e0c38df128d3d54f5805f183386f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096750, "uuid": "de93598e-5221-4481-be2e-886b3a9b2bb2", "value": "T1C7756A03F69989EAD55DC078C3169276BA36B88A0730B6EF2BD45B343E56F902F1C315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096750, "uuid": "06122859-63b8-45c7-b9ee-f9f90a0eeefe", "value": "af0199946ed5f2b1b5fec75e379d5a86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096750, "uuid": "6bc1b06f-c994-45f3-9516-608a09d71bc7", "value": "24576:DziLGvkT63kXyD/9iIHdMG4foHbok2G/pRQExAflUD+/B/:DziKvo63kXy79tHdKfoHbok2GkEi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096750, "uuid": "606d4ad6-721f-4bea-a294-7cfe87732506", "value": 1664512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096750, "uuid": "a736e93d-7945-4b55-b2c8-8b5b9329ad3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096750, "uuid": "e5858aa7-a977-4432-824e-ac57e19d9d11", "value": "dbcontroler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e51b4b-b7f3-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762091569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091569, "uuid": "cac408d3-0932-42ea-a444-991f49bee131", "comment": "Malware payload (ACRStealer)", "value": "74b08f843e9ab1013fe032f38123d652", "object_relation": "md5", "Tag": [ { "name": "138-199-199-150", "colour": "#0D1A49", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091569, "uuid": "bd77a251-83e2-42b2-a6a5-e241a451c34d", "comment": "Malware payload (ACRStealer)", "value": "4472995386bba315a57959fb727042bbdc54c186f20610d6073ee0d4329aaefc", "object_relation": "sha256", "Tag": [ { "name": "138-199-199-150", "colour": "#0D1A49", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091569, "uuid": "88ff00e0-0842-4419-bcbc-05f4687d8b27", "comment": "Malware payload (ACRStealer)", "value": "7dadaa113639147a0f8c7222e30de6fb10998043", "object_relation": "sha1", "Tag": [ { "name": "138-199-199-150", "colour": "#0D1A49", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091569, "uuid": "6cebbf30-cdea-4c6c-9f38-18d1879f9af5", "comment": "Malware payload (ACRStealer)", "value": "065a529446e601a7cf02a962545f984eb13a1de61e8174a8e2d6c0b8ac88daf287daee8e4efe4b65b67b37d67f9fdfe5", "object_relation": "sha3-384", "Tag": [ { "name": "138-199-199-150", "colour": "#0D1A49", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091569, "uuid": "1e250d98-ed5c-4a49-ba3d-76d27ca533fe", "value": "T14C673349DAE419F8C4CB732C961F9D87D3D01101F67A9A6F047199E6CFF87C6282898B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091569, "uuid": "c4aee291-cff4-4d77-aaa6-43a1364b321d", "value": "786432:KjX6nHvsqYcy+gPtIUYGFptoTS/QvqXbm:Kywc3gPtIRGFptPQsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091569, "uuid": "5df4f682-384d-41b2-a024-bf0145789ddf", "value": 31214351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091569, "uuid": "7e4e2da7-9824-413e-b0c4-aba1fd0a3d09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091569, "uuid": "33a27a49-29b4-4f26-91a7-1bc1ba344521", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1195d40-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072042, "uuid": "315960fa-1740-4321-89f5-4f7628c8e0c9", "comment": "Malware payload (Mirai)", "value": "16405bc16aa2badcc4b4632d001ee1dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072042, "uuid": "19316a63-2c8c-43c3-b681-c2a38580f4f2", "comment": "Malware payload (Mirai)", "value": "4476513ae57bca9d6f719632950c08fd453507e31521a769d640ec04e081b701", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072042, "uuid": "827515fe-7788-4de0-8c58-74b393161f7f", "comment": "Malware payload (Mirai)", "value": "ae7ba2a0ffd6ef1e5f94cd90c76136fc54206c24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072042, "uuid": "251d79b7-fb72-4c22-b8fa-469bba4005f9", "comment": "Malware payload (Mirai)", "value": "a353a335ba36c6f6b4578b68224232fdb35a085ed4cfb05e6f4f6d3d1d6cc523050cd79ec1acded8242a776f83cf5165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072042, "uuid": "ef6e7516-a524-4968-892e-753db6c82775", "value": "T1AC330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072042, "uuid": "2ddb4343-7c9f-4fd0-aa29-001254f96353", "value": "768:gduPBFnHooqR8qOCKq20H4Y3e+TK806MMUVjzMfQXOtHud2oGY:r/hqaJ053eqK806MHdMfQXoHuCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072042, "uuid": "5521db2d-9ce4-4838-9bda-892135163029", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072042, "uuid": "24444e35-42dd-4904-92b5-e1d7ba9ed920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072042, "uuid": "e43e87f8-b138-4766-9d25-6db763f1cbc8", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c67428-b845-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762127024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127024, "uuid": "33897e93-e377-4059-8b95-40afd80ab59a", "comment": "Malware payload", "value": "71a77a33f16d2457e4be835396a044c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127024, "uuid": "ceae0b7f-c1d3-4aa4-816d-200d7c32026e", "comment": "Malware payload", "value": "4585eedc82ff70d1e7b15528f8e367e564eac55c6d496c88f9f81d67765c5509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127024, "uuid": "3465a614-f7b1-43bb-8749-fe8489b6a729", "comment": "Malware payload", "value": "5ebe60877d1a1d42b166125bc650684de7838655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127024, "uuid": "682d0723-d911-412c-8309-ecccd7c06140", "comment": "Malware payload", "value": "5bbc94a8ffc53a06c5740936a0648c0226f3b28cfc10ccd8ae34c9259c9e102dd92e6926d560a67290a5686658f97acb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127024, "uuid": "213cb462-369b-49a3-b773-ca7f31b97cc7", "value": "T12163A50AEF550EFBDC6BCD3705A90B0535CC651A12A93B393578C92CF54A50F4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127024, "uuid": "1b63b4f0-72ec-4d72-ba28-22ff2b46c0ee", "value": "768:52ycG/QdVBcyqnXmjeOqLFe1pgouodRETxw5i7yEYJXZUhxIXidX8/NecxR3JqQM:52zVqnCjqLFgpgonz0KBZUTo/NtxRJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762127024, "uuid": "cf49d7ab-a9d8-440e-9a3c-d2bee4dad8d8", "value": 68468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762127024, "uuid": "3322caf3-6a36-4831-9e4f-712d4cc4c640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127024, "uuid": "f5fd1785-2433-4b24-9e2e-da547c8176d6", "value": "wewe3.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386e2edf-b815-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762106172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106172, "uuid": "087d5a41-ff2a-48a8-b6c5-7642a39b02eb", "comment": "Malware payload (RemcosRAT)", "value": "0625498925e982604b6894cd828bcd35", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106172, "uuid": "e5ef61b8-c1cb-4ad2-aec2-b44bdba0e944", "comment": "Malware payload (RemcosRAT)", "value": "458acdf5e4f42250d95ee2dd701959f6a6c1a225e67a2a2f2b19b60c888e377e", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106172, "uuid": "9731ccfa-8ccb-4a7e-ae15-cbd09df252a7", "comment": "Malware payload (RemcosRAT)", "value": "4defba7f94399c349214a27147cd95dd1b32f4b5", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106172, "uuid": "4ed90b1b-54e1-4573-9571-330d4b89e2ad", "comment": "Malware payload (RemcosRAT)", "value": "4dd35be919a0b506a30fff1e44094cce896336db6e0700bc9cbc84e5c1513e3e50b48dec4c84284a78371984b36aa3b4", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106172, "uuid": "eef96506-865d-4aae-84b6-105b79cb3ceb", "value": "T1038423E46061E9CFE39291B0D484265DEAE2F31D82E5959098C4DC6CC6F7ECF6349E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106172, "uuid": "3483310d-7b8e-48f6-ad60-68c511ea08c5", "value": "12288:ScgiqxR9bYl/vKaOy7EVVWwoF4SF5TjPHpsQLB:WiqxR2l/vKo7SVVoPF9+Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762106172, "uuid": "0b6d33e8-6b21-45de-919a-cfb73e486175", "value": 403490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762106172, "uuid": "d09506ca-af6a-4f9e-8f2e-69a0dbb7046c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106172, "uuid": "2c2cd469-258d-48cf-a6a0-01a20add1091", "value": "Inquiry RFQ.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dea25e-b7ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762096914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096914, "uuid": "0137933d-bb3d-45c8-aea9-fec8fc6c3e70", "comment": "Malware payload (PureLogsStealer)", "value": "f2ad555bbc2bf5e8a5c4f0d51c49a0b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096914, "uuid": "7b6c6fa6-371e-41b3-a575-28df896e9b44", "comment": "Malware payload (PureLogsStealer)", "value": "459615f3382371dac440eba7599b0edb98d6f0b83ab795f75ce1fca29d2ab66f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096914, "uuid": "d1f0106e-95fe-4d46-8df6-9b5c989c8ee0", "comment": "Malware payload (PureLogsStealer)", "value": "eb084422994faef3d76fcf38b4fe0a24a641216e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096914, "uuid": "d8c96b2a-75f4-4b0c-8238-3b3f79e84b62", "comment": "Malware payload (PureLogsStealer)", "value": "63bda84c27a6e67b130973185d3551c519220d3bcf687017f72810749d491e9b42a1206588f418c3d5bb1e18494b301e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096914, "uuid": "9b7c9836-2d77-4a95-b43b-d1fa920e7bc5", "value": "T1DB86D0168DB19365FCE76C39AC7D97A24E63FC5C3F32829895E0426C1E61C92DD3A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096914, "uuid": "0284d8ae-327d-4b52-bfef-4d20ad613706", "value": "88315cec9d0bbeefe946e3c32b1d5b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096914, "uuid": "17caa201-3bda-40c1-a448-bd428b9587f2", "value": "196608:c8axAg9ihbfQhL3tD4D3+WygBwhOlDJtbgy0/N5vdMjnJ8Xiv+8ZtiQEoYIZ3p:c8aqg8h0hL39MJC6DJ9gzRM98XiGw8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096914, "uuid": "613bfc8a-ab8f-446b-820f-c980139cd4f8", "value": 8066560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096914, "uuid": "5181c2a9-a621-4eba-b8fb-c255ba497f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096914, "uuid": "13f0b153-9a66-4278-892e-a78399a75cf0", "value": "udpprotocol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4768e7f-b784-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762044103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044103, "uuid": "63632406-4b4f-4684-a251-1f0999ce7df0", "comment": "Malware payload (Mirai)", "value": "43aff21b6dd391265d31a7532b6dbfc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044103, "uuid": "009ff9a9-ea47-43cc-9ebb-282ef793e700", "comment": "Malware payload (Mirai)", "value": "4721e6e5ec76f4677507317856094c0437e2f52af26f21ede83cd7d3eb288471", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044103, "uuid": "b322a01e-e380-4afb-b5fe-e6ae2d3341f0", "comment": "Malware payload (Mirai)", "value": "fb857051f927c91a74c664206860e499f9fb4546", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044103, "uuid": "2e1a3d08-bc37-4400-9f20-4215bdf94d25", "comment": "Malware payload (Mirai)", "value": "aa2e1fa718caaa2f1e3fbcbc1ea0aba70973972b76b496e7c1158b5eb189af4e5eeb4e39aa0d609a5988f8b456875bfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762044103, "uuid": "99abfc19-601a-491b-a0de-a9857172afae", "value": "T136732956BC815B15C5D41276FA2E018E33131B7CE3DEB3129D215F247BCA96B0E7BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762044103, "uuid": "5d87e8c4-1ebc-4d21-8818-88645ab31101", "value": "1536:VEnLlBmw14DidrNJy4P8Xx/xy2xqkUp1WGt5oeqaH920WZ7BjiR7fAE7GyY36x:+314D08H62jStWeqaeqfAECyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762044103, "uuid": "d88ec490-f3fb-4fd5-96f8-d02f6c66969b", "value": 79200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762044103, "uuid": "4ac3db65-5978-4c19-a1eb-2650cd1b9bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762044103, "uuid": "0fc65fd5-ee51-41b4-b1c2-702054fd5773", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a2d639-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103797, "uuid": "369ac348-6953-4556-913d-0b4223d6fa5f", "comment": "Malware payload (Mirai)", "value": "c90286b2bb99e30a33717baad2d630d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103797, "uuid": "c718a02e-e7ff-4c81-921b-6f8c6c9b50bb", "comment": "Malware payload (Mirai)", "value": "48c1d8a890e582ea1d6b487d8ffcd5de76cb697a786f86bfecc0642814fc5e3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103797, "uuid": "cea4c83b-ef5a-4aca-80dc-9c7bc56633b6", "comment": "Malware payload (Mirai)", "value": "8be14c1f44819b5bda74f2c1c83c0553e77f44e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103797, "uuid": "9cbfe3be-841e-4cc3-9562-11bd3a011908", "comment": "Malware payload (Mirai)", "value": "3dff37b543356c2836fde2cf00dee363df4d5cac466d5ded84108969d70a3ff7e1f4a8a1cb247e67b410a578e88f2bea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103797, "uuid": "42d2eeb6-53b4-4f0c-877b-70a6778da866", "value": "T10723F791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103797, "uuid": "d2507018-ef96-4ac5-9c1a-415e03772363", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THR:5DmKF7Gxyk8cqoHAmWurAufse5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103797, "uuid": "195e7d96-7fa1-476a-93c0-0150f05510d1", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103797, "uuid": "e5043deb-fbff-4f68-9e1f-9a5026a33b73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103797, "uuid": "5700c5d3-5d16-4da9-b9d7-cf969b64e0ad", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fb6bad-b83d-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1762123509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762123509, "uuid": "2779230a-129b-4d2f-89dc-53562bb15b5f", "comment": "Malware payload (DCRat)", "value": "ce94d7f24b3a59916191e70604d702c7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762123509, "uuid": "69c9e829-a2e9-471b-b814-9f20fb44203b", "comment": "Malware payload (DCRat)", "value": "490cc90ecbedb6ad1943b5f76b40e415ae0bb6e7588d869e01094b0aa8604686", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762123509, "uuid": "a2efe312-ceb6-4d47-ae58-a28728e8556d", "comment": "Malware payload (DCRat)", "value": "eee697f66ee3fb3ab8200342db5839765f70aac7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762123509, "uuid": "a74077fa-d4e5-4dae-9d92-9f6d41475fa5", "comment": "Malware payload (DCRat)", "value": "faae43bee337cfffeab0d56e1d0af4d29dec65d40047416aa0c7de2071a12d8296ea76557def10d3e3983a0658c87d47", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762123509, "uuid": "90952d4a-daac-4590-90d6-ade9c487af03", "value": "T1CDA5BF0655D29E77C2701B714497403E42A5DB3639B2EB5B3A4F20E2A8137B4CF762BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762123509, "uuid": "87ed44be-beab-4deb-9c63-de0d4129fe2d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762123509, "uuid": "67640985-a163-4b73-bf20-bb14fdeff9cf", "value": "24576:2TbBv5rUyXVZ0US5djN7js5j63pzwXDdk8zdKFJuMc2aAIHtTOY7SrbpOsZanW:IBJu9xWpHUcsINTkpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762123509, "uuid": "4c547c3c-bcde-4e70-a4f0-599759a29afa", "value": 2238656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762123509, "uuid": "ca84cebb-d2f5-4f78-8cd0-23901627c8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762123509, "uuid": "3f9dfa55-c26c-49dd-8c61-605458f58206", "value": "CE94D7F24B3A59916191E70604D702C7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14b38db-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103798, "uuid": "1c1448da-db58-4ef8-bca9-2847a7f7cf8f", "comment": "Malware payload (Mirai)", "value": "ebdb97c7c05ce73f649d5bf9dd1116aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103798, "uuid": "8043f9cb-4e71-442c-a0cf-166d24cb3e76", "comment": "Malware payload (Mirai)", "value": "49f6edeca6f9556da4b55057581488baf48855b85013f4413855fb2a7f116c8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103798, "uuid": "0e1e6893-2224-4982-9cea-449c4cec286e", "comment": "Malware payload (Mirai)", "value": "8fd184dc8ba6ad95ed0c2d60426291cb7ef82035", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103798, "uuid": "4870c29c-4067-4e04-83bc-678732aefe9f", "comment": "Malware payload (Mirai)", "value": "d6e5bb7f2c480101bd76cfdfde183873bf132c5e3ce323c597c57802a063aca3b400cd20e72aba23f8300be22c618c04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103798, "uuid": "5ff5c24d-f5a6-48fa-9f8d-0739808ecf9e", "value": "T17D630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103798, "uuid": "06d738cd-f09f-40d2-85f1-d333e1033027", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlgr57uscvIGiojd70k7h:VqVMkWV8PP/9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103798, "uuid": "82975812-be29-4e79-bb75-d53667d0e419", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103798, "uuid": "d59c33ac-27aa-46ad-9613-40ce8507cb24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103798, "uuid": "f3285856-ac59-415e-88ec-4dbcba4e405a", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0840a323-b823-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762112105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112105, "uuid": "3d1cea99-9115-428e-95b8-aa8604f69acd", "comment": "Malware payload (PureLogsStealer)", "value": "6a9fa1e5afe6f5ca41c306a6b64d2507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112105, "uuid": "d290b3c1-a40f-4b51-b0fc-50e198a929df", "comment": "Malware payload (PureLogsStealer)", "value": "4b18a8bf774b4074ff2d0cc95f6d04ddea8fc0e76318ab8f399ce19f88e950ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112105, "uuid": "c122aa2f-93c3-40f7-bb21-6f7aa54201f3", "comment": "Malware payload (PureLogsStealer)", "value": "5d9b7b947466041a7010496cedcee83d8e9878f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112105, "uuid": "b7894f7f-cc96-45f9-b448-bfb99b157fb2", "comment": "Malware payload (PureLogsStealer)", "value": "48a915384f411f97ffbb89d915d58cef08740043ae17d6930ea74e88f35fa09ecdc3045678584333986b734570850319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112105, "uuid": "ee0aa053-4f3c-45d3-a115-419d13258c9f", "value": "T10903D1051FE5C6ADDDAE0B3948F392545270E7822A2ABB0F94E9D04C5F77704CB42AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112105, "uuid": "7f8f3e93-8abc-4e75-8573-1b4b3b6ae204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112105, "uuid": "91fcb8d3-5e75-4f3d-978f-c79e727bddee", "value": "768:EJHy7ULu4mYSSzMqgNzArjbsYxW+E0wMa7CIM5qpv0eJ:eHy7Y8Nq5rjhR0Ma7RJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762112105, "uuid": "801eca71-125e-44d5-a715-781f16025a37", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762112105, "uuid": "d971e3bf-e0c7-430c-baf0-2d73ae8350d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112105, "uuid": "ae58a149-7e93-4990-81b1-3f7f5f1af5e6", "value": "4b18a8bf774b4074ff2d0cc95f6d04ddea8fc0e76318a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91fd71d-b7e3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762085021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085021, "uuid": "cbdeddb2-1a4f-4a9a-bb47-6a35278aefd7", "comment": "Malware payload (Mirai)", "value": "12229d466d8135b21bfa367f006fccb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085021, "uuid": "bbb53c2b-c584-4f45-8440-1098b93d9801", "comment": "Malware payload (Mirai)", "value": "4c071505063cf1e390c9444d09e67818b4d4dc48a2df3cd9cf5d2378c22cf590", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085021, "uuid": "9633a5f9-a25e-4717-acc4-42ab96733a6b", "comment": "Malware payload (Mirai)", "value": "8bd2b18b6ab64e63b9c57c1adaf60f24b7095722", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085021, "uuid": "e48b4758-5788-4d21-9e71-6f09b7a5c619", "comment": "Malware payload (Mirai)", "value": "6fd89991aa3b540829aa768787ccd9a21f771597f451ffa4b623644cb7c404ec1a652eb92edf1264344ca9f95516bd18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085021, "uuid": "5c0a6d64-a658-49b7-b96c-b8ed4e3591f7", "value": "T15E732891BD816A13C2E12377FB6E428E332553A8D2DF3207DD226F1137C695B0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085021, "uuid": "14989d68-6bb3-437e-acff-ac9204085649", "value": "1536:8y5oec7rveTkC3lx+TeqGP2Xi0GpkV6czDFohHsTuO453V0R83vbZo:8yiP7jeYC3AsP2LSiXfFo+SAsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762085021, "uuid": "9069a774-98b9-4ed9-a538-c0bfb2fe938d", "value": 73660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762085021, "uuid": "25067d7b-5289-4123-a703-9bb01baee11c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085021, "uuid": "a41bcbf8-4514-4d30-ac65-8f05bf9f1707", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d3e0db-b83c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762122994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762122994, "uuid": "31e3e9f0-8643-4029-8fc2-ad5b245f0cb1", "comment": "Malware payload (Rhadamanthys)", "value": "7b00f0b51dfcbdd8a7cc28841a655dc5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762122994, "uuid": "1d15db78-143b-4eb6-8f77-d2b5be7a1e12", "comment": "Malware payload (Rhadamanthys)", "value": "4cb620428080d0a2d9de18bbd702f1dc66b732946a1bb93f6adbb05940ccaa1d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762122994, "uuid": "784ad4e2-c098-41f3-9c25-9f1bf38852f4", "comment": "Malware payload (Rhadamanthys)", "value": "4fee7cf42dc07ca6d4fc391be2fedbc147da2ba1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762122994, "uuid": "bbad0f64-d69d-4e1c-8464-8f93da3e15a4", "comment": "Malware payload (Rhadamanthys)", "value": "8f5d578cc8c988cd59c6d574d85b6fa2c4f82cc895bd173366602db65096d8e40734aeadb50f3ae29a65cb54111bf494", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762122994, "uuid": "2384d192-899f-4929-bd6e-38b5f8cb1ba8", "value": "T1F475337463D6905DE8624BB885F112037A7BB4A61F38A2FF3AC4C77C89536D55838F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762122994, "uuid": "f358fe82-f788-440d-ae7d-e19ac363f378", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762122994, "uuid": "69f53e3b-4671-4d2a-97e3-f66e601cd2a3", "value": "24576:rjvqszqRz9usa2TIOkBI8OTXElQNOo8p8YTl13eNV8Jhe1DTFBCkGX6BD5BX4iKT:rjvqsczC2TqBZBl5pXT0MhsDxcxHQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762122994, "uuid": "1fcd9309-57eb-4a60-aa2d-20a2fa246980", "value": 1671168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762122994, "uuid": "450e2192-923e-4c33-8b79-1b210aa4d7b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762122994, "uuid": "36b0358b-c25e-4514-9f45-f194a3b28e45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3550d21f-b7ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762088558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088558, "uuid": "e521cdbf-612f-4b27-8885-09da5808770c", "comment": "Malware payload (Mirai)", "value": "ae709889dbcd910fda285d62b8531a4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088558, "uuid": "ff6c23b7-9a41-425e-a02b-124295e88fa7", "comment": "Malware payload (Mirai)", "value": "4d0bf673c3cc92c672bb555d19b4d10f99d64635de43b86c91b65eb88c872a4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088558, "uuid": "1deecfc9-646f-44fe-a33c-6b46d33b2c21", "comment": "Malware payload (Mirai)", "value": "664920582b9ed946b34de225458e0b7ff8b7b4b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088558, "uuid": "02b520ca-d97b-471e-be4c-13f708e239b7", "comment": "Malware payload (Mirai)", "value": "e5903dac59e012393d7fef0be0b24dd67ac1068bad8d7b6b409497fcc9c9680558a0a6236472e531e366437c0e10828d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088558, "uuid": "1643cc29-f8ac-4693-8c80-b2be905610fa", "value": "T17D830956F8814F26C5D502BAFA2E118E332327F9E2DE72129E209F2077C652B0E77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088558, "uuid": "9d3cccf9-2b2a-4ec3-af73-b344affcba9f", "value": "1536:wInjCsmF5IFZ1SoRE6DiXtADbAu5oJ59ecyOazan6bI7iUb3XCah43o5LY4X:t25cZ1PEY22P1PZOaMb3XCah43o9dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762088558, "uuid": "dad672c9-4f76-4fce-bb1c-fc9517309997", "value": 85008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762088558, "uuid": "e8c53e95-caf7-4973-adb4-ac9dd30c85df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088558, "uuid": "5f5463de-b016-4c1a-ab23-fb4bc63fae7d", "value": "SecuriteInfo.com.Linux.Siggen.9999.3816.2770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e537fce-b7e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762087365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087365, "uuid": "9be0265a-1eb1-419a-9307-f0b9ee85bb96", "comment": "Malware payload (Mirai)", "value": "7c601505dbfc6d1bf11f15f2f56f9068", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087365, "uuid": "728a215c-0d81-40fd-81f7-3ce80f656ac7", "comment": "Malware payload (Mirai)", "value": "4e41993000ec4c9b2794d1d475334dda44488ce9b996f1e3837bb1d5fd5097ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087365, "uuid": "234ff61d-94bf-4861-9d6e-76428f5a989b", "comment": "Malware payload (Mirai)", "value": "43a782be12f7732714cbb30377d96197ddd5a22a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087365, "uuid": "8191bee4-8e8d-4966-9bda-2357d5efaa73", "comment": "Malware payload (Mirai)", "value": "f7cb030153aa7de77ee7910944f1938782403516ded9aa310ee055958137df17cc233ef247aa35d6557eebc0c4439948", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087365, "uuid": "2ec42581-0d54-48eb-9339-b9a06fd922ad", "value": "T109E2F1E16911C78ACE90703E619CBC5F43EAF5202F08C8972A9DC14D7678DB0D76E176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087365, "uuid": "025ff9aa-3712-4bb4-aaa0-2234f7ce5de5", "value": "768:qLSt/dr+XOghVrO0Xeky4BBo4cS8LajrBgXYz:yGAhVHGQ8SrCXYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762087365, "uuid": "987807db-2692-4b6b-afd1-ef9eb740d84f", "value": 31360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762087365, "uuid": "e06968c1-befd-4ecb-bebe-df00bd48b96f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087365, "uuid": "7857f0aa-7c79-4c6a-8399-0a355df68567", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6e808f-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095177, "uuid": "06423e9a-dff7-4f1c-b4f4-2f60721ccba6", "comment": "Malware payload (Mirai)", "value": "d61c8185aeb7f5c5fc45cc1846b246cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095177, "uuid": "12ff2212-9a5b-426a-96ea-ccf4bf9ed39c", "comment": "Malware payload (Mirai)", "value": "4fe401227d4d6a4b2c6e78405f1fda8ec500396e5a88dc1afe13fdc018d472dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095177, "uuid": "e41409f9-f214-4b28-8d99-ccd0d3880544", "comment": "Malware payload (Mirai)", "value": "c23f94e20c2184ff4edb1cf940b5cdab0405dab4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095177, "uuid": "078f8162-290b-4e84-80f0-8121ba7d384e", "comment": "Malware payload (Mirai)", "value": "19013c82f01f5a6e3d0e81b58ec20439ad202523b7cf10c6d29cab1c98952af4a05d129730e3cd2f96400f00bea14d4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095177, "uuid": "e67455c5-479d-4ea0-8276-d1c37c409f17", "value": "T1B703D03C4A0904F4E56FC17EE3ED47E0653607AD6542CE462150F697EB0E8AC78A7AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095177, "uuid": "56886654-a3d8-4469-b0a4-29955857de9a", "value": "768:lgN29x3ZpzZ5VjNuvtE54Fe7GbxBDbYsPs4P5MhcJ3JgGlzDpbuR1Jw:f9xJZZNKNFjBfRUMWcVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095177, "uuid": "59748d12-9976-4ad7-a963-6ef809f65e63", "value": 38076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095177, "uuid": "d315e010-c9a8-4636-90c5-936b067b6409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095177, "uuid": "ca8279ae-c306-437d-99a2-14feb9d75c60", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e482366f-b7ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762061364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061364, "uuid": "4afd2801-e172-420c-85cf-6119a83aab21", "comment": "Malware payload", "value": "0eeb5fab475093cc5dff1276619cd2bb", "object_relation": "md5", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061364, "uuid": "dde850b7-e329-4f31-963b-e9b0b7df4cfb", "comment": "Malware payload", "value": "4fe4cd89a17d45a10810a02f753793572de4af1bbaaf696c7d3b5e4ac6619876", "object_relation": "sha256", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061364, "uuid": "58b3e1aa-7421-4122-9b5e-c31d0eadf550", "comment": "Malware payload", "value": "d3af8b7da7bbe18bd557d43eb71782f6ea229800", "object_relation": "sha1", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061364, "uuid": "9ee32cde-7785-4ff9-ae40-2bca1275d748", "comment": "Malware payload", "value": "d949202652b8e4e3c2b66be15a1663d82b0b786e8b6876fd5f0d35918acf922cbea305619a6969d9dc77ce9bab981e7a", "object_relation": "sha3-384", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061364, "uuid": "f7427c5d-6102-4137-b2c6-16fe159635ab", "value": "T1CF06DF21653643BCD91E0BF74972C0A881E3CE253E97C767B20932A7A1E105B75D2BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061364, "uuid": "25761cdf-87c9-4033-a0fc-76454257637b", "value": "98304:S3Kwn0jI2XMCSR7Sf0qMPoSGSuVg/mYtZ5xcTwYiOjmq2pW+yoK15BA:S3Kwn0jI2XMC27I0xCTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762061364, "uuid": "ecfeec1c-2bd6-4b9e-89ae-15dbfe59d42d", "value": 3653542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762061364, "uuid": "b912ec9a-8630-480e-adc7-d758c91cb52c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061364, "uuid": "46311090-891f-4f63-a18d-9ce5ed51bce2", "value": "proton.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6097cde5-b7c6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072310, "uuid": "ca652101-2cdf-466e-9147-58d4e40a76d9", "comment": "Malware payload (Mirai)", "value": "aab1b762e868197bc78ea83ceed969b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072310, "uuid": "b8efba4a-a60e-4189-982a-3b52038c90ea", "comment": "Malware payload (Mirai)", "value": "50aa5f26d676e07f729ff510460b44b45d59287947709ece9262998e43698eb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072310, "uuid": "4d647762-cde1-45b6-9d68-68b71eaf6624", "comment": "Malware payload (Mirai)", "value": "8251ce1b516ace517a7e945a65653fed83a0679f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072310, "uuid": "5a1146cf-a86e-4307-8c9b-1018728dce0b", "comment": "Malware payload (Mirai)", "value": "47fa833bf460047a4508ef4d10529cdd3d11867013aa46f6ee1c81d17ed84f89715cfb439bcdeabdf33dbed2c9d80b58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072310, "uuid": "d9c521fd-ce07-40b6-aafe-51784ed0b95d", "value": "T159230991BC818A2BC2D41379F5AF998E3361B3E8D2CB7227CD614B107AC551F1C66FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072310, "uuid": "5d314c72-f909-41f6-b72c-2bea59d15732", "value": "768:ioHTwOcm1zHwLADnl9OYW77rQTZQu8LStjB8/cICdjMiVYHUGyVIDKoKEuMqTRJy:ioOm1f9Od7rQ9+StjBDhwOvQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072310, "uuid": "6115566a-a6de-4894-a550-50969c19d87b", "value": 47100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072310, "uuid": "eae2a911-a9f0-49db-900e-052dccd38a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072310, "uuid": "76daad84-130f-405b-966d-c0b5c3a9494b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f52e00-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762103786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103786, "uuid": "347b6ed2-df7b-4df4-b826-4f7158cd6743", "comment": "Malware payload (Gafgyt)", "value": "145bea5be61be4a1e0849aee83ffbd1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103786, "uuid": "46b6d8cd-bc73-40d2-8063-62b164cb13fa", "comment": "Malware payload (Gafgyt)", "value": "51919576254b24acac956a09ec5d40c2f984e4533f6655ec0e1fdc14ced698eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103786, "uuid": "f51542fe-5d16-4ced-b0a7-4f58796177df", "comment": "Malware payload (Gafgyt)", "value": "559358bfbeed762230e186cb21dfd5bfe77c1417", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103786, "uuid": "19348005-9d0b-439f-a226-6b8cb04c5b2a", "comment": "Malware payload (Gafgyt)", "value": "f023a7eeef81bc6e687d842fe175933cdd9572594eece0f43beec26ffbca21735edc2591a399922a8c62f62c72842910", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103786, "uuid": "7e8f3fe8-8148-4829-8b66-97be749b5302", "value": "T14C047379BB618EB7D80FCE7305DA4912188C968652E93FABB3B4C528E75784F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103786, "uuid": "848ababf-90bf-4fe1-a021-83a581af759b", "value": "3072:SWFNB6EaVctPj95h+jTuhmv8uqx1BVnKoe:SuwHy795h+uhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103786, "uuid": "49a298cc-3ff2-4e34-8826-61536b5b01e0", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103786, "uuid": "fa6ce0f7-5e54-468f-84c4-31a5239ac6af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103786, "uuid": "56258d86-81a9-47c9-8642-4cb6205d216a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705014e5-b810-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762104119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762104119, "uuid": "82e94371-1b01-4af3-bae4-3f7b68dc53aa", "comment": "Malware payload (Mirai)", "value": "76b3d5adeb406e2ca19e7b1378566783", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762104119, "uuid": "ebd3f1de-63d3-4096-8bd8-ba6e55ca56db", "comment": "Malware payload (Mirai)", "value": "51ef155ce9cfa22f1e9fa6be61203c3039f1eff092ee01689b939a57517db3e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762104119, "uuid": "ad9bd3d7-93bb-43b4-b404-75a7d2872a65", "comment": "Malware payload (Mirai)", "value": "5f38de36645dd2faebb86bfb8dbd9ef940266eff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762104119, "uuid": "6256e2fb-4d37-46ba-b7cd-3e637972fe26", "comment": "Malware payload (Mirai)", "value": "3f4eef73f6ba33e996b4d59d31d9bd9cda567f9b2381ba9fbeca51c53db9b43a1318844f0af43449122df3969899b020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762104119, "uuid": "d11bd924-3d71-4903-b2fc-f790d67914f0", "value": "T1CB441B02AA414F53C0C20779BAAF42593733EB6493DB7302DA14BFB43F876AE0E66555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762104119, "uuid": "fb5efa0a-18e7-4a08-9ee1-497e65bfd39d", "value": "6144:QLneJfFd5xswJXTaIuu2cHpBdkjP7kcC2omWKYXPvakJJiomC:QLneJfFaMXTaIOcHAx3omWKYXPikJJiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762104119, "uuid": "bb22cb1e-5a57-4043-af21-7683c43018a3", "value": 263267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762104119, "uuid": "4e50ca5a-3bcc-4388-bd56-5107e469d6ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762104119, "uuid": "941b56b7-5385-4b50-984a-eded73faf7e4", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04ca4f4-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072067, "uuid": "c83489a3-e7b9-4d87-aefb-203e7dccf774", "comment": "Malware payload (Mirai)", "value": "7cc77990ec629ce3a1a3f501df0e7572", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072067, "uuid": "2664b90f-b697-470f-95dd-1fc132dfec4f", "comment": "Malware payload (Mirai)", "value": "52bd3e5d5c510ae5ea981fa7bb6b73c29e1ee6e2d9a632c71a968edb4aada3cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072067, "uuid": "f0ee7851-db2b-4e61-bc23-915022e3dcb8", "comment": "Malware payload (Mirai)", "value": "539c8f17c2901de473f5775cef8e65fbf1ebdec0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072067, "uuid": "84e5419f-ec94-4b84-b30e-78402f521e93", "comment": "Malware payload (Mirai)", "value": "e17e028a9ea69d5d7f232a0bd31651d77f37424a5f58df2545f31b8089a4bd8bd24f2fdaff571f26e1fa48ca527b1509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072067, "uuid": "165f3137-417d-4dba-8efd-c8653bc4bf58", "value": "T153334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072067, "uuid": "e316edcf-587f-4789-a209-951e1b57b81d", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GgPS4yns96BktDgIPi8Twf:ivW3jdQGqt7Y+Z+vN9cGgI6bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072067, "uuid": "72298dad-0948-462c-956f-0ba981041dd5", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072067, "uuid": "f4d2807f-a41b-4cd2-bc0e-15ad0f27ebde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072067, "uuid": "1f42e580-0325-49ed-b8f4-7fc02d1f5158", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90357871-b7e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762087422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087422, "uuid": "08e69a22-a669-4873-9f39-9c7510233b35", "comment": "Malware payload (Mirai)", "value": "6655fc737b94e0f1a661e7c467360b97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087422, "uuid": "ed060be4-3f0e-49d6-ac40-1f42b760486d", "comment": "Malware payload (Mirai)", "value": "5318aca70da84e754260e637725d3357283b0b63d112171b8e1e20c3d2da0d30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087422, "uuid": "0dc27b09-6ecf-42ab-b39e-c102933d11a0", "comment": "Malware payload (Mirai)", "value": "efab9b29e57478a7842140a4a798db0d0b7dc488", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087422, "uuid": "30654817-a214-46c4-8b7c-092a1e698473", "comment": "Malware payload (Mirai)", "value": "4a4e0c7363adc6b763019d72584cd598a247490c7a735b89a1062238a05f035beda5524da86323f9622a8a01c5a2a79c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087422, "uuid": "3389bd52-4417-4409-a3a7-f27ae889fd76", "value": "T199535BC0E543D8FAE89609B06036F737C637F53D502DE967C768AA72F852A40D61639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087422, "uuid": "eb345bb7-afee-4ba5-9b97-183a98bbd14e", "value": "1536:+L9bp89EiV2/gX9BufIPdKpyrJmEXhFELTRzOJeRKYfBQifyTO4dN39f8Zp4i6/l:+L9bq2iV2/gX9BufIPdKpyrJmEXhFELs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762087422, "uuid": "ebfed27e-9821-489c-90b0-2ddd079ab6b4", "value": 62356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762087422, "uuid": "00c0b643-7df1-4e24-bea9-a0136dd2642e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087422, "uuid": "5994eb81-b0f4-4e9f-b79f-2a4ee8413e20", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9668f714-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095163, "uuid": "0d16fffe-462a-498e-91c7-8c759cc32f6e", "comment": "Malware payload (Mirai)", "value": "918e402eb60e21cbcd5d9a99f7b1d7ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095163, "uuid": "cdc038e6-3711-4f1d-8732-9de1e89c9bac", "comment": "Malware payload (Mirai)", "value": "535411283c9d708321b7408adf22c2d440c4ef04cbbd2b3b04447f0fc9ba9336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095163, "uuid": "8fdf5f46-c5db-4121-a762-68587d427031", "comment": "Malware payload (Mirai)", "value": "cffeab8e78c094aebfd62e2b4933a8edc6b292d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095163, "uuid": "c2b1de21-8c95-4511-8527-2a767a44d6fb", "comment": "Malware payload (Mirai)", "value": "a765617c0d4b4df414341fbe9a51938bacd714695c38a9fac5c1bec5ed36e2b9695567051f0ebc4cdd2365f6ac2b8ec6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095163, "uuid": "4a11a1ee-765f-41df-b945-cd7accbc343d", "value": "T1BD733A57B98080FEC499C43843BEBA36D87274FE1379729A13D8FE366D56E601E28C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095163, "uuid": "08d68f0e-f0a8-4bf1-8715-ee954cb703e1", "value": "1536:BzIDxEwvZ8bvf24MIb/+w4HnC+8l8AnzcUl:BUxEyZ8jMIf4HT8l8AzcUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095163, "uuid": "67b027d2-322d-4d72-84fb-736386b0bf12", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095163, "uuid": "dd4e6a4a-65ca-46f5-ad84-9765fa3116c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095163, "uuid": "976f60ee-65d4-416d-a777-c50e41afc8c7", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ff7649-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074253, "uuid": "d1bcc9cd-9c9f-48a7-b19e-15ca55fac18e", "comment": "Malware payload (Mirai)", "value": "0fa7dcedef90fa7ab33032c6ed862da9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074253, "uuid": "efa2e9b9-064a-4feb-aba7-cfbc8457c47b", "comment": "Malware payload (Mirai)", "value": "541130ede2799cfbf35de2ff884e2cadb02b787dedb50d78a6cbc31b16006674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074253, "uuid": "6cd5076d-0134-46f9-ae93-4d7c81e61156", "comment": "Malware payload (Mirai)", "value": "8396a91ffcdb773e4b39f2aeab50a8fdd10b9763", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074253, "uuid": "2b8d9775-2036-4465-9178-1e6f2667422c", "comment": "Malware payload (Mirai)", "value": "047972646c004d9bf37827c022e8f2e7c121fcc9377818f81d1323b332a66e052eae6cf91a41b8cbfe5c3c3875c53809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074253, "uuid": "78b9fb9b-9836-4e1b-941d-80fe9d3bd616", "value": "T14113E1E9E0082D8BCA5C55FE105D67B59914E0D4213F0B6BEB3708EC619394AF8AE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074253, "uuid": "1ab03a27-71cf-4475-b37e-a75347ef99b7", "value": "768:5lImd8NLKsamynN9FW5x57QZUPN/QUtvjVwfiyF/4s9p1FN8nrp6hAzWC:v8NLK/myNHW53S+yUhS9rFNKrcAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074253, "uuid": "a7a7bf22-6df9-4444-a807-a6add4d3a668", "value": 44692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074253, "uuid": "9d0727ea-8837-4a1f-8b06-80563f2d935e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074253, "uuid": "57c4ee17-93bc-4d65-8a72-3db808646c92", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b79f738-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095172, "uuid": "d5f86a48-5492-4625-906e-4c2ed0957251", "comment": "Malware payload (Mirai)", "value": "0576abcce86374383671e291d207a9fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095172, "uuid": "10a3c28d-e5b3-4263-a42f-41771aaf1725", "comment": "Malware payload (Mirai)", "value": "54c0c9c87bc6f02bb8118f8701028f51f69e4d5ffb4c5ce3a7011e93765bf722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095172, "uuid": "ecff8d2b-c018-4d7d-9201-54f5fdc5808b", "comment": "Malware payload (Mirai)", "value": "392dccc63d0cc9a521708161d57a0a7ffff594a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095172, "uuid": "f252bdfd-cd5c-4e13-b5b2-d88e14271d40", "comment": "Malware payload (Mirai)", "value": "39b4ad5ce2a5bf8d89afe6f5e18571aed7a1a33e765be20ab54b895ead765d055e966cbf3f03dc80c114c7c9cbb96210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095172, "uuid": "20bdd3a4-45dc-4103-ae4d-e1244d4cc508", "value": "T10E13199AFCC24A3FC1C01379A6AE5A4D3761E3E4D2CB7607CE585B3136C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095172, "uuid": "2083db27-d631-456f-af60-688b82d10804", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCwHoOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095172, "uuid": "e4279bf8-15dd-4b77-8b2c-4779a3370059", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095172, "uuid": "6a27d97f-fab9-4550-9e44-0b67c8e521cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095172, "uuid": "9ed916cd-915a-4945-a916-5149f8ea8084", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23f82f3-b7f6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762093116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093116, "uuid": "d2828bc6-44bd-4691-8df1-9444569b8847", "comment": "Malware payload (Mirai)", "value": "ef9f063799bc7382dd13a2f85d477bf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093116, "uuid": "a086cc55-eec3-4d4c-b40d-a48191f59839", "comment": "Malware payload (Mirai)", "value": "553642b43ef5715ca94066a8d7cf9cb3efae30b9d3a00b53b0188f672c33e9db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093116, "uuid": "fcd48886-e04f-42de-9c22-b12e1938a2c0", "comment": "Malware payload (Mirai)", "value": "d38e4f1683b420b314031a9c20095e99a6b85026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093116, "uuid": "d90ce7a9-e0f0-4cba-bb65-0a381c2f5ab2", "comment": "Malware payload (Mirai)", "value": "3f58e85c813ef662be1cfdf6659a1796d0ca7398232f2aa15e53d4bcc272bff7bb5e1c5f698a6945402cb1709cd96b2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093116, "uuid": "14112619-e446-488f-ac17-a493292d839a", "value": "T1DA44C70E7E229F7EF6A9873047F38A31975972D617E2D644E16CE6101E203CD641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093116, "uuid": "55bb2d4d-e384-44e1-b5fd-0bfdedbf2ab6", "value": "6144:KZsF2W3D/zWfEguSfy6WqcHyeEy5IT6CF70dD5tZUWi:9bzDXZbLEy5IT6CF70dD5tZUWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762093116, "uuid": "f0e7ccdb-2c85-479e-a6fa-879ee575391f", "value": 256354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762093116, "uuid": "a34c23ea-1548-4670-ae0c-6859d8f90b92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093116, "uuid": "a5186744-f776-46be-9d74-2915f00e80fa", "value": "SecuriteInfo.com.Linux.Siggen.9999.4536.13056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5990949a-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095061, "uuid": "efa8f9c0-ba97-49dc-90ba-41860d8c3b26", "comment": "Malware payload (Mirai)", "value": "4d60c8eb53d72ebcef59a464f94c3d01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095061, "uuid": "c204f409-cf09-45be-8d95-51502eb32070", "comment": "Malware payload (Mirai)", "value": "55415eb373b09e347c6528214758673a8ed465d2365a0920a85d7d865c6de7d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095061, "uuid": "94fc1ded-b5ce-4a9e-82ac-976f12cd7bca", "comment": "Malware payload (Mirai)", "value": "275ec490279d6fcc47e9f3d14b9f87f9d459a4d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095061, "uuid": "42dfca3a-bb30-4ee4-9a0d-e799f63e7850", "comment": "Malware payload (Mirai)", "value": "5a8d614c5765a3c33af933dc99a072cf6ef4638743e878032feea854b8e3cc5a9ddd7319842b3dd92404c8492565cb72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095061, "uuid": "4810caee-c8e6-4836-89de-f5e1a3473cf0", "value": "T1A892D07051377CB2C7612533E62F8502896603FFCAF5317A225465A4DA8458F2EA998E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095061, "uuid": "9e7aab19-32de-45f2-8804-3908b564d21a", "value": "384:kf3CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8pt+hIhymdGUop5htM:SCyEPgoKRwZGx04nIns0t2VIs3UozLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095061, "uuid": "9492444d-fdfd-4126-836d-da2fc4ae2085", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095061, "uuid": "ce9793d3-f29f-433c-acb6-bedce0f237b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095061, "uuid": "60266223-91d0-485a-96d7-8ae58378ef1e", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a5ca9e-b7c6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072313, "uuid": "e4609f03-83ea-40fc-a741-3e1f8b31ce6e", "comment": "Malware payload (Mirai)", "value": "f0189b66479651fac94ba5e4ded04f00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072313, "uuid": "47d8f976-1e4a-429a-884f-18b7086e6e83", "comment": "Malware payload (Mirai)", "value": "5689e0b8aa82a44e13e0a010de449686a1f04b14235bbe23fa9494fb85836178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072313, "uuid": "f3e6f342-0baf-435c-a099-510b0b6e1887", "comment": "Malware payload (Mirai)", "value": "7572ede8f258388bfe3074a582efa18dc19b5799", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072313, "uuid": "97a660fc-bc9e-4004-860e-b52f2369f60e", "comment": "Malware payload (Mirai)", "value": "45643c0a3afc8fca66580b87099c3cd492fc7468f8b0e753e21eca0b648e699f3c3ae2ecc7f4568c6e96edc797a59674", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072313, "uuid": "804958c3-4bc1-4c2c-8742-4acbde40c4f8", "value": "T1FC73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072313, "uuid": "278a34a9-b403-4de8-a4fa-a1e3e7508783", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStM:zJPEB8NWq9Jqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072313, "uuid": "30cb9be3-06b2-4916-b372-a1cc68f48a77", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072313, "uuid": "e914f33e-b56e-4160-b14a-1ce1063e1767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072313, "uuid": "84329ec1-38a8-4d78-a74a-6f7de3f5b685", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5798765f-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095058, "uuid": "6e5ac21c-669f-429c-898c-6582c2191d7e", "comment": "Malware payload (Mirai)", "value": "5a770d3420c356750d50d354814aa6ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095058, "uuid": "d2131111-0df9-4e98-b8f6-76468907b2aa", "comment": "Malware payload (Mirai)", "value": "56e1cee39ef126216bcf33e4a96d0814f48c84eb956e8916ad71402e18f00247", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095058, "uuid": "3f83325b-ae61-4614-a27e-0fcb8a28c76d", "comment": "Malware payload (Mirai)", "value": "d19d38ee164e4d10cccd95c8ac6681f340de5963", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095058, "uuid": "6f857ffc-b95c-451a-ba07-228a515cca8f", "comment": "Malware payload (Mirai)", "value": "d400f9395d69b7c45955f5c563813ddf7eea7e1cefe73484d61b2f334c22e5190e5e3b66ce3d609d11f19229ca42d4a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095058, "uuid": "f954babd-361a-4fdd-80c0-567ceb3d3629", "value": "T14083199AF800DDBDF80FD6B74463490EB931E3910A931B377767BD63AC721A14826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095058, "uuid": "906b4911-fff2-4d61-85ee-3d3ba658555f", "value": "1536:4v7sC9KZbx5uW8eqL/ydYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7ICn:4G5hJd9lJP4npeqp+psrbICn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095058, "uuid": "31936a08-2c85-4faa-84c5-8139955fd78a", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095058, "uuid": "1174e7d1-b19b-4130-9ec4-2c1fb227c562", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095058, "uuid": "c05c4840-2ecd-49fa-b69d-8d91d5be2b69", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7f0f4c-b816-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762106775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106775, "uuid": "2b3d0e66-73ae-4e7e-81fc-50b65da25f22", "comment": "Malware payload", "value": "cdafcb16229e1f6a768543474f9ef055", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106775, "uuid": "558df420-fb43-4e98-94d3-b16797d83e6c", "comment": "Malware payload", "value": "5846ab89e6b4a99f701a438d3beb5afeb920ca6434d9f262e3ab469bda8a34d4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106775, "uuid": "b3836aa5-e2da-45ce-b270-71d9886749bd", "comment": "Malware payload", "value": "573a132647187b5d6639ef787dbdba940f66f824", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106775, "uuid": "996b9b65-6e6f-4a04-9a67-0c54402f6d62", "comment": "Malware payload", "value": "443355c407476ae9f2d45070fa18888548916d0e5e040a73d3ce6f5a43c0f73291d89a95fa3d99df18e379ff28a82b06", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106775, "uuid": "974311b5-6c92-4e86-85f0-454535b0dac2", "value": "T1A25533D7813C28C49F3E0A5766BF851C62188DFC204308B76B5A89A7663F39F877495B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106775, "uuid": "cd91fe6e-bea9-4944-9b32-392b3e437a1e", "value": "24576:roZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRWX0nv9Abde:roZ9bq+MmMEL+hcjXHC/wnwdTKbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762106775, "uuid": "45d08bf8-3f84-458c-96e1-cb37987a3030", "value": 1386685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762106775, "uuid": "00558c74-bbfd-487f-ba03-44aa428403ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106775, "uuid": "373fc2d5-fc22-4d3c-895f-5c06d8bde9f6", "value": "Select2AI_Extension.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c588e01-b817-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762107145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107145, "uuid": "54d24c80-712c-4764-b25e-0c6fc8b87999", "comment": "Malware payload", "value": "d31d47e4d8ad586f61ea0634079e209d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107145, "uuid": "213fd05f-8223-4d79-bcee-ce0f9b7180c1", "comment": "Malware payload", "value": "58809b23057eb2fa242de1d43cac4a8dd26ddd4bc3a9cbd58e77a04a7bce26dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107145, "uuid": "1a154b4c-6a4e-47d4-8597-c2c64035ef75", "comment": "Malware payload", "value": "fa2fd52d9431e24521fae633f2533768ab8a042f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107145, "uuid": "69caffd6-204b-49de-b6cd-fb19a144c53a", "comment": "Malware payload", "value": "3b52a4524c31fb78d8b89895f2e24f26da084fd02dd5474c26ff79f4cabb3d057df4a326866b9e1a8e96fe5affbe847a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107145, "uuid": "c82d4713-ba6d-43ab-ba6a-94b8deb59573", "value": "T1800184CEA472FB460618DF04B0A78E79A015D2C2A3F0CF69AAD40E368CD8E013119F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107145, "uuid": "0e11029d-3ca8-4e79-bbc0-d1c8c28758c7", "value": "12:z9cS4KXcKNIl5Tc30LKIXQD+ObQUJpXQoI8ST8STt6/O2yDjv:JLNI7VKIAD+jUJpAojrMqPujv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762107145, "uuid": "e89fd66d-ae0b-461f-9da8-915edf399459", "value": 694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762107145, "uuid": "2836f7d6-36b3-4a13-8785-a6aa44804a0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107145, "uuid": "5740aaad-1e90-4377-8695-e69720b7c6a0", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d219fa-b7b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (VShell)", "timestamp": 1762066948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762066948, "uuid": "8174175e-f5ec-4daf-8d23-e1a79573a811", "comment": "Malware payload (VShell)", "value": "22d8ba9ac0cb50d560210e76d4337bfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762066948, "uuid": "232f06dd-cf49-4932-9fd9-be2accb740b8", "comment": "Malware payload (VShell)", "value": "5bde8bdd08f2248eb947cb6242b2b788e1837cbf6e5b0a25187500dc8bed75cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762066948, "uuid": "7f0e8f6d-09b3-4d9a-906a-accfec6635fe", "comment": "Malware payload (VShell)", "value": "5dc6432a001c3b7f39db901a472a37ee0c90d473", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762066948, "uuid": "a678430e-edce-48fd-b66e-024118975dae", "comment": "Malware payload (VShell)", "value": "01cc36e02c9ace0a5fb4acc2e36d1acf9b62f6a5b2127124b762f93f68fd9983a1a8decf27682a56c45898ee80655b68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762066948, "uuid": "f2a2ed1e-2d1f-4554-a183-b1f88ea4d733", "value": "T10D862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762066948, "uuid": "0099a1ff-f936-4da4-b99e-a87c04284771", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPXE:glRJXp8L/KyZcCb79hEew+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762066948, "uuid": "af9daa4c-1d90-48d8-9b42-1b923ff91bbe", "value": 7864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762066948, "uuid": "65cf713c-90ee-4aa9-99b2-0cd872a5de86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762066948, "uuid": "159f0328-98fa-4fa0-9000-c24fffb036f6", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb62ef5-b7f8-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1762093724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093724, "uuid": "0841d4ff-84f3-4597-86b7-1cf94e785e3c", "comment": "Malware payload (ConnectWise)", "value": "220276c76c19a3f01b9fa8f172b96407", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093724, "uuid": "54e518fa-38aa-4385-ad52-894c91427cad", "comment": "Malware payload (ConnectWise)", "value": "5d37c15512685f518e28b8f1094b112e8f3cff619d6f0b6ef74d87f79466fa33", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093724, "uuid": "97398a4e-094c-4b32-ad21-8eb336c5aaa1", "comment": "Malware payload (ConnectWise)", "value": "9936aff2f3df1286f67bb3853c045d9674b99d5c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093724, "uuid": "7229bf5b-9563-4033-b932-c984f3b6fac7", "comment": "Malware payload (ConnectWise)", "value": "e87f7e48c1d51a95acb157fd3b8d29205b555038afccc24b63702454fa6d9c67a163d3947867951dfaa049d8ce37c892", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093724, "uuid": "565dd11d-e64d-404f-99ac-9afe62b05234", "value": "T1EAE5EF01B3E44136D5BF0635DDBA66229B75BC190364C7AF57C879A92E737C08A323A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093724, "uuid": "6d5fa95d-24fa-4a3f-8529-eb27af2c50ca", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093724, "uuid": "04e6f7d3-a605-4827-af1f-ccf9b21d4b9d", "value": "49152:XjET0+TL3Z0Mi963PSuArmh69eWbVypVCTgGu/aYmn1gC:Tb16Co69eWb0pnGpYmnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762093724, "uuid": "fd9fd828-67fa-4a92-b2c1-71f7243701d6", "value": 3138840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762093724, "uuid": "657a9e84-d165-4108-bdf8-20e426c0c15a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093724, "uuid": "b7abbccb-3bc8-42eb-8242-a0cd4e36e99c", "value": "Index001.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d1bafd-b7e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762084178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084178, "uuid": "3d2fbf03-bc72-438d-bdb6-c4a89479931d", "comment": "Malware payload (Mirai)", "value": "9bd0c7e4f309137c00ad47d19e7259b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084178, "uuid": "bd301ac6-ec8e-4b2c-b7c2-ab803095d56d", "comment": "Malware payload (Mirai)", "value": "5d9fe073f9a35dfbf6e30fd4d5a6693ddd1355171af1647da54f3400da98e8da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084178, "uuid": "670324af-4c68-4453-b534-71fdf3e76cc9", "comment": "Malware payload (Mirai)", "value": "a844f7436d670eb6d2312dc0e807a3bf9f233938", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084178, "uuid": "fc216094-fd1b-4d41-a57e-316f9da9d2c0", "comment": "Malware payload (Mirai)", "value": "ad515bc717cc163530b2b442e0a369e3b44d4207c8dc4f7f14ef22a31951a883a244b8a9221c7bc947061ac6f3b5675a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084178, "uuid": "33e30b04-c8fb-486c-a664-2e5b078a1a86", "value": "T16A732996BC819B15C5D4127AFA1E018E3323277CE3DE73129D215F247BC696B0E7BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084178, "uuid": "ab998c73-02a3-49a9-b066-f8e2a06e5688", "value": "1536:PVnnF32wiWHCAnAw39nPxjIQLM/zYeCRq5Vv0aXaRi1AWL7VsiCKknYUAY3Fp:DiWHWOJGrqqHv0+aCLknYUAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762084178, "uuid": "b24fe446-6d6a-412c-a7e3-aa4f8705b1b9", "value": 80420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762084178, "uuid": "6dcad8d0-e99d-4ee6-b499-13678b5415f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084178, "uuid": "b1904cc5-7952-4acd-aeb6-0a1deefe23f6", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a91cca7-b7f0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762090446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762090446, "uuid": "a7a0841f-4f7c-4549-b32f-430b36bb4373", "comment": "Malware payload (Rhadamanthys)", "value": "95f24a3ccdd5f531a3461e3431894e1e", "object_relation": "md5", "Tag": [ { "name": "144-31-3-108", "colour": "#998E77", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762090446, "uuid": "f4afbdd6-4c7c-4d07-b1fb-c012610e68a1", "comment": "Malware payload (Rhadamanthys)", "value": "5df8dc57b9b97522aadc906667f82a1185e6bbee062ae9fbaba297b1ccc57b58", "object_relation": "sha256", "Tag": [ { "name": "144-31-3-108", "colour": "#998E77", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762090446, "uuid": "d1d44268-2883-4135-9435-1043b9a48ef7", "comment": "Malware payload (Rhadamanthys)", "value": "8e91ff4c7589f13afb38bd646a04d6af5bc71a4d", "object_relation": "sha1", "Tag": [ { "name": "144-31-3-108", "colour": "#998E77", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762090446, "uuid": "09747b26-3e65-41ab-8119-e63b51c73ed0", "comment": "Malware payload (Rhadamanthys)", "value": "c0ab1e08ce6d4615c82a5d11aa67c5a421e3b7f60f99bdf9d9a62ab1f19af0de92a484e0d8f5abf76eff4401a14a46db", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-3-108", "colour": "#998E77", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "up4pc-com", "colour": "#C93DA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762090446, "uuid": "5a088d0d-f09f-4d01-a060-641368ab73e4", "value": "T12C75230A56E950EAF13657B481F242ABD132BCB12F6C03EF67C4E57E5D322C0857972A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762090446, "uuid": "3e94775a-f95e-4398-97f4-3b3aa2f2dc72", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762090446, "uuid": "5e2f0fd8-86f9-4e80-9ae4-d50595b0b421", "value": "49152:hjkMI8RHU6Q0kXhaY+WgA3ZZcdxUf073aL:CMIklYC1AJGdSfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762090446, "uuid": "3873fe55-59b3-4ce9-a021-be1c3ee2aa5e", "value": 1650688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762090446, "uuid": "60e6b2f4-48df-492f-a263-1015a444b1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762090446, "uuid": "a7409026-4de0-45ad-975a-d88f9d527550", "value": "Up4pc-Compressed-File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd555c4-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072062, "uuid": "0b57d775-b93d-41d9-a709-a5665d3ca967", "comment": "Malware payload (Mirai)", "value": "60bb8e069b0123545c48f9354fa1e6e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072062, "uuid": "09a7346c-2dc8-4d7c-827e-51591f5e05c1", "comment": "Malware payload (Mirai)", "value": "5e58f441b32e3bcab3c49b2a5bcbd9b8fbac557912b641bf0fb04eed027f30da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072062, "uuid": "5f0e21c4-c854-432b-bae7-ec32de88bb2e", "comment": "Malware payload (Mirai)", "value": "467617955d5e4ab7178e37cf2ee3b20f849953e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072062, "uuid": "1b910e59-938c-48a5-a61d-8f0664c08e33", "comment": "Malware payload (Mirai)", "value": "28dc4abf7b8fff3359c145f66b7bea4903ad5eb4932ff9f86daf8b074014637300f84b45c996708497f3b25b33210d2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072062, "uuid": "6d3ed9ea-29de-45c2-96e5-8558e4bbf718", "value": "T190431991B8819A13C6D4137AF56E45CD3B2133E8E2CB7217DE214F617AC681F0C6BE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072062, "uuid": "1d459023-e8b8-4c1e-9b6e-6cf8b6b92055", "value": "768:nVRQCLzOD6NZCwW9bYm0smQZQw/XV1Xw3c+c7O4tQoY/xzAHUGyVIDKoKEuMqTRc:DQCtW930smkNXVxhOWQ/zYGuJleAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072062, "uuid": "86d0cd62-55c1-415e-962e-d2f36b9f3846", "value": 56176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072062, "uuid": "5bb68f21-8d73-4de9-ada8-0d24311852e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072062, "uuid": "0999ddaf-d02e-4ef8-ad47-f3f7eb2266d2", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8c2d69-b781-11f0-91c6-42010a9c0006", "comment": "Malware payload (FixStealer)", "timestamp": 1762042879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762042879, "uuid": "e4458f64-4f53-42ca-8162-b9debba9b971", "comment": "Malware payload (FixStealer)", "value": "7c5684d04f9898e20d4e93cd6ff88c14", "object_relation": "md5", "Tag": [ { "name": "Fix", "colour": "#A36DC6", "exportable": true, "hide_tag": false }, { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762042879, "uuid": "60112b6e-168e-4552-9307-b9cbf90074f7", "comment": "Malware payload (FixStealer)", "value": "5fab2405673d1ed1646907d86d9a65556809b2e8994f6e2d562ff6c60c613f81", "object_relation": "sha256", "Tag": [ { "name": "Fix", "colour": "#A36DC6", "exportable": true, "hide_tag": false }, { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762042879, "uuid": "c35dd855-d297-4b0d-8829-1fcfc96c28f5", "comment": "Malware payload (FixStealer)", "value": "f9dc8819de9edccc4920c1666b91954e4df75519", "object_relation": "sha1", "Tag": [ { "name": "Fix", "colour": "#A36DC6", "exportable": true, "hide_tag": false }, { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762042879, "uuid": "dd093432-cc5c-431d-ab61-4d46ab2a8957", "comment": "Malware payload (FixStealer)", "value": "973b779bb6e78be69e5efa31b9d159b1cdf2fe7da4ce62999e5bd13657399c97e4d06362c88d9c448d05f8b35f1008fa", "object_relation": "sha3-384", "Tag": [ { "name": "Fix", "colour": "#A36DC6", "exportable": true, "hide_tag": false }, { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762042879, "uuid": "65e10363-b31d-49fd-938c-fb35c30373dc", "value": "T1D92833C955EB0A12F80BB6FAC77D293D5F325D1A930392B37874BA0906712235E72D4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762042879, "uuid": "50461c4b-797f-4627-9b66-bcde7bebe214", "value": "1572864:RqcuCSber90nj/OxcJl0VISqOulpvL8ROxj8EAZjBUuPmq5p3I7Vt2AKj:Rqxer90nDOOJiVTqplGQjCBFPmyY7Vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762042879, "uuid": "d029f886-1d24-4567-9f06-6e6a1a8480ba", "value": 93966336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762042879, "uuid": "c483f5de-2e83-463a-9d40-b0344680a73c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762042879, "uuid": "a3987285-8890-4fa4-9f2b-6eee4531a8c5", "value": "skibidiInstaller.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038367c6-b7a8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762059268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059268, "uuid": "4740b64e-52b8-4036-9641-31af3809aa6c", "comment": "Malware payload (Mirai)", "value": "251e10ba73c5a7e18ed7e1a7ed76b434", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059268, "uuid": "f5ecbd29-861e-4b70-ba5f-1831f26fd963", "comment": "Malware payload (Mirai)", "value": "607ef3fb3bfc09c41edd15aebed6047a214d607e8f58459c550fbf24320321ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059268, "uuid": "a4e46216-fc54-41f2-be1c-584e33c014ff", "comment": "Malware payload (Mirai)", "value": "aea63e1ba6a0b1587ff8f3f67395d22760377586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059268, "uuid": "9de14a0a-9a9c-4886-9d9d-69f718b88ea0", "comment": "Malware payload (Mirai)", "value": "bf4fe9e3b261a19709f635ac17a8dac201330a8c7909f9a623da3e66fc87b8f22dd8d76c99f7fcbe281a63bb7e778428", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059268, "uuid": "be07f13e-14aa-4d09-836a-d3d10b133dd3", "value": "T19CE2E0E4C354EA1FC6F3A1B8252C863CEF40B92524B14585394392C662B4A78DD8EF9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059268, "uuid": "0ff4f515-70d7-4954-a7bf-7ecc4ab07fab", "value": "768:J1+DsYNUb9ZwA4eZGG/3DbMNYnwNbdTyAtx195ho9KyF:ys6UbPwpeZZTqYn+yEx1y9KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762059268, "uuid": "fc9bce2e-3604-4b8d-ac9b-a1368e49ccf7", "value": 33380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762059268, "uuid": "3a364b82-d9ac-48c5-a2b4-00b62c8eaa27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059268, "uuid": "fc070685-ffe8-4b15-8985-f5c387d7c93f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7002a37-b7b7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762065985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065985, "uuid": "a17aaf09-ffc9-4004-86dc-c9f016d1479a", "comment": "Malware payload (Mirai)", "value": "5244df5555c9344dc7a539d37a75917f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065985, "uuid": "b652d832-50ef-4613-b205-8d77edbefb6d", "comment": "Malware payload (Mirai)", "value": "609d072cb8f66ffeedf24f44a74a78b8e701b258bb0c13470595c7b7287cf7ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065985, "uuid": "6fa70476-914e-4632-aee0-ac35e7664f65", "comment": "Malware payload (Mirai)", "value": "dc8cd1b440c7c7e86fd3508965a586ff8b450355", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065985, "uuid": "a0b9d897-4151-474b-b36d-7913e43e52c6", "comment": "Malware payload (Mirai)", "value": "69b2c390e708019d716519a1418f7aca06622161bb88ee3a84121265748c6f3670d17cf033002298dc0c79c6415de110", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065985, "uuid": "1fb202bc-2bd0-4bdd-a4b4-1a29509d657c", "value": "T10D538D33E025AA94D05895747431CBB52713684082E76FFB597BCAB9A08BDFCF2193B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065985, "uuid": "3bd95956-c996-4998-8a89-687fcaf646be", "value": "1536:saq0H/Q+5g55eV+oG5xYkKayq3M/ZCF/IJAH:s/y/WsVmxYLaO/Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762065985, "uuid": "45031b24-3e37-46a2-9208-0dec1fe095fb", "value": 62656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762065985, "uuid": "391e9eda-79ba-4fa4-9778-9d4f3e30dbd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065985, "uuid": "69749007-fdc9-4302-add7-82d4f0c2c05a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc346e4-b7b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762064921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762064921, "uuid": "4ba9fbce-1a58-4f82-b4e0-afb0364ce103", "comment": "Malware payload (Mirai)", "value": "d560cc94e039b1b73647a9639976e004", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762064921, "uuid": "7302d3a2-926d-4cc9-b884-3efe1089a337", "comment": "Malware payload (Mirai)", "value": "61d2c858f9166f6ec600e6bf898bd38729797ecbb5698844e547665515783c14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762064921, "uuid": "2a879224-53d9-4b41-802a-58834c183ccf", "comment": "Malware payload (Mirai)", "value": "d23422457d18a892c111042b80a9c8eff741012e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762064921, "uuid": "23820d41-5462-4a5f-89b4-48582a68058f", "comment": "Malware payload (Mirai)", "value": "87b09f806859b5ae442775b2db290e4b7f3a96e9995ab85d60594673137dc531803a2c9eef0aa59f5b50574de7db4c9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762064921, "uuid": "374f6a67-a710-44e9-8113-cc6cde626c1b", "value": "T100D2E1A19219C13FE462323F8F1C2D4E03AD5D6AA3FC98E57B66D58F5CB940C82B4C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762064921, "uuid": "54c12eb5-0e17-4071-9c24-4ea693cdbf23", "value": "768:7NOgkhWCES76kA7aKQ0CI6PXQ7W3IGy5TWnPsRk:nC8h7ap0CLo7eby9kPek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762064921, "uuid": "c0dc4c35-e603-47fe-9426-3584bca44d1a", "value": 31016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762064921, "uuid": "395e6d49-1498-40b8-a497-7f6132f93133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762064921, "uuid": "42200837-75ba-4ebb-96e3-ed0f176dc1e2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1297f1f6-b7c6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072179, "uuid": "97f6cb42-ec50-4b95-b681-aa54d7758070", "comment": "Malware payload (Mirai)", "value": "be5c67d780f3ef349dc5e64fa83fcd3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072179, "uuid": "4221f0a1-7e33-4f82-94fa-3a244354e36f", "comment": "Malware payload (Mirai)", "value": "61e61cda063599515176032f3a4e9a5ba46970930306cf196788bffa585aafca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072179, "uuid": "18eea033-0486-48ac-adb7-b0f0a17d8d17", "comment": "Malware payload (Mirai)", "value": "6ed1f7e52f661a43ca2f91bd97380e178bfc83c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072179, "uuid": "7452db29-6805-466a-ba67-9636c2883f23", "comment": "Malware payload (Mirai)", "value": "f51a282fc00c36447a967c802330e723824503b85534962766eb5c26c666fdec81375a476e696a2ae60977b530e1bf71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072179, "uuid": "07cb801e-6d2a-43e5-9a73-c940931a9ce7", "value": "T19AA2D131BFA644D7C473643C82D8E8DA22529D66E3ED894216D5C05BBCB33D99434D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072179, "uuid": "ddcd9391-d6ca-4253-b0a0-4946178b57a7", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkLaYujg6LFUamvF0jxiTtR/SSy1:O98o08kxofBE+ZkLaYujk1oiZx21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072179, "uuid": "1e30d056-eb3e-4522-b000-795a2e2645b2", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072179, "uuid": "df2dcaa6-4707-44f2-86e9-3b554ebbe395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072179, "uuid": "b1f0e987-5742-415a-aaa6-b4607275514f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34593ab7-b818-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762107454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107454, "uuid": "e27610fc-4621-4bd5-9cbe-8281ee384b5f", "comment": "Malware payload", "value": "4c35ceb61dd227359adfb5460566b309", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107454, "uuid": "642bc839-dea9-44b9-b8d7-fd6d43c81195", "comment": "Malware payload", "value": "630aa755331ab6e986384bc6e760b8aaaddea550ac2921124ff7b3e2ce142acc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107454, "uuid": "c88ffc21-698f-4487-8ae6-91de5d796c64", "comment": "Malware payload", "value": "bf45dc58f3db2246542a5eac079dbc85584cd73f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107454, "uuid": "377cf3ae-d3fe-43f8-b287-cd342946c441", "comment": "Malware payload", "value": "a0f62e8a6951295967249e2c2ff4eb9444fce3a311ffc61e48f52eb82ad43d293b561c1549494f8548ba4d43d6d34ee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107454, "uuid": "212813d4-cdfb-4240-9b14-6e08c67a88bb", "value": "T136D3E70ABB600EF7ECAFCD3705E81B0625CC656722A93B357674E918B64B14B0AD3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107454, "uuid": "f702795b-19fd-41a2-b015-e61452c5c19b", "value": "3072:PaVwAgWdYaNIGVNeJ+hhNBFnH+Mlr6gDbB:awA3dVNIYg+/NBFewrtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762107454, "uuid": "9eb44829-49fb-46bf-95cb-18dbe80f56ed", "value": 135780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762107454, "uuid": "4a8c17c5-35ba-4267-8eee-28b4d5fda63c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107454, "uuid": "9c9d27fa-5786-49f2-92c3-55f1849da178", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a22c30-b800-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762097395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097395, "uuid": "0009c4e4-7ab0-4af4-92a9-1d84a4ff6a0b", "comment": "Malware payload (Mirai)", "value": "fbded11193f4493b755abe4140d5d1ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097395, "uuid": "55257ae0-b249-4425-a211-1bf219dea702", "comment": "Malware payload (Mirai)", "value": "630b05178282992a6597b5911423ad120e18cd5096f640c27a49e93e852f6a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097395, "uuid": "7bca72e8-d582-4883-ae90-179358841f1c", "comment": "Malware payload (Mirai)", "value": "09c7b2e116692f357aa703a45f8d58d0ef6f8fe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097395, "uuid": "0a753c91-c95b-4792-adf0-53a27cda5de9", "comment": "Malware payload (Mirai)", "value": "c1b049e0602d7ed12f138da6ecf5c00e330c01b7905f5e039241c9030408da1c40487acc5a22b5cf0c735cfa02caf1ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097395, "uuid": "01626eff-6387-4bf7-a714-595b7567d58d", "value": "T15A143B02371C4A43C1676EF026FB17F087EBE9911AA6B544F21EFE945272FB16449F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097395, "uuid": "cfc01f12-a678-4305-85b9-78044972d545", "value": "6144:x7ZnlxY15RhX4iIuXrE/09P2sWZH/frzvToP:x41ZIgrE/09P2sWZH/frzvToP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762097395, "uuid": "9783cc52-3d56-4358-b729-6d405eda6b7d", "value": 206806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762097395, "uuid": "4e409e25-4ba0-454c-8783-2baf975c3590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097395, "uuid": "2fd193fd-fd81-4c21-8047-369b4fae3d08", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7c73c4-b7f6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762093080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093080, "uuid": "8e1787ac-40cd-4c53-a3a0-41d8a2ce79e9", "comment": "Malware payload (Mirai)", "value": "1c30dc7e99c15e1e33aaf8d860c4cd20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093080, "uuid": "34e59f9b-4a18-4aa2-aa7e-c4a9c4b1d021", "comment": "Malware payload (Mirai)", "value": "63f72ca705d69a230e3828903146d88f233a25142e49ee0be153740b5ce3efb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093080, "uuid": "58b33d38-1566-4493-94a1-c44d83efeffa", "comment": "Malware payload (Mirai)", "value": "c091bda03614918e69fdf067d92fe115177c7d2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093080, "uuid": "baaec388-2ee8-4bcf-9b4e-4445fd915b1e", "comment": "Malware payload (Mirai)", "value": "d9a2e787af250650794dc7fd531a64a6941574e45a497d2e5d610f26b8c6ee05a03c33023fad59d478b4704e0e202b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093080, "uuid": "3023cf74-7ba8-4613-b65d-bc91d565b67f", "value": "T1D163027BD623F07AC378A8367690EAB031B15F7C94F706BE2316836575DA8D1507C216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093080, "uuid": "d5198180-ba20-4cc0-a42d-0e95d1edc1b5", "value": "1536:sNPs/O/UoGQhQ1656cgVqwYLfDN1VGKz93CMA5P:20/O/UgX6JqwYLfj3I5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762093080, "uuid": "87c61fca-f1c5-4b56-8f18-7128fe27ef66", "value": 67996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762093080, "uuid": "66326fc2-94a5-4396-827d-9d4458a681c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093080, "uuid": "ee51fa9d-c39e-416b-ba79-e9e3cc7acb43", "value": "SecuriteInfo.com.Linux.Siggen.9999.19676.7227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8804ccbc-b7ed-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1762089126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762089126, "uuid": "ffff5978-383b-44bc-8788-ee29db0a7f08", "comment": "Malware payload (SalatStealer)", "value": "e4b3969987477eb0d569483864a3bc80", "object_relation": "md5", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762089126, "uuid": "5e4f4392-aca4-4865-b901-e92044c4415f", "comment": "Malware payload (SalatStealer)", "value": "656583be8e0764d2ea8e75d2b98639751d0712ca21b6bce04f43001256338194", "object_relation": "sha256", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762089126, "uuid": "932c7010-f77f-4555-ab9d-6c9efb8d1f26", "comment": "Malware payload (SalatStealer)", "value": "9e21d104b665a97fe3e89136f871bdcac27af60a", "object_relation": "sha1", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762089126, "uuid": "a59cf287-213b-4637-98ce-e8ddbc4d84ce", "comment": "Malware payload (SalatStealer)", "value": "3eb277ccac83e786de198fbe6a4d6424bc72106d2bca06babccf841d0bd8419222da116a4743dfcfbb2c1b25fdedc04d", "object_relation": "sha3-384", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762089126, "uuid": "7d3cdec5-9c8d-49f7-a3ce-9e7aabefea04", "value": "T1F6F5338D0D330191D6E222315CB57E2095BE2E44D0C684AA4CE9D87F5B41F6C6A7FFAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762089126, "uuid": "d5ec675c-dfe2-4c26-a3c6-a32bb390b2c2", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762089126, "uuid": "4cc9bf85-53e0-4195-9523-73e7f41fc08a", "value": "49152:hu2xa7ga30tfWJS6yIiK2McItYiku4b2TCJg7gjUpbllqwvYS/irFKNjNRG9DLug:Q2LH6SL2klaTVVf7dari3GlLumY61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762089126, "uuid": "85b1a682-db5b-4233-8e47-1f92fe74fde5", "value": 3558400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762089126, "uuid": "14a16685-4c6a-4610-abcd-22ba80de3fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762089126, "uuid": "72c1eff6-e49d-4bfd-9114-26a8a86027b2", "value": "DiscordFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0289fb-b78c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762047420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762047420, "uuid": "60203a3f-7587-453e-89ff-cb58bc86a9be", "comment": "Malware payload (Mirai)", "value": "edaa2c94663c3d199e1a6bc97fd5898c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762047420, "uuid": "d949a5b0-6e91-4f35-a495-0aa689e97633", "comment": "Malware payload (Mirai)", "value": "678461efc3190d5731d22028927750a4600fdd7c9bfe34e555ac416c172e7341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762047420, "uuid": "5c0431dc-3488-46d8-9893-4c6321187422", "comment": "Malware payload (Mirai)", "value": "47e8d147f4a36b46f1edcfa7dc8f35afb9d80aa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762047420, "uuid": "61bd5689-b910-43c0-9144-e2e2c33fd749", "comment": "Malware payload (Mirai)", "value": "dd09bab2686873524f5754f211b3d3cf7ca49d5cbab1b11d78593610392c062b9868a2a83a8e461017c13cd90df17114", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762047420, "uuid": "e76f82d4-6c48-4c85-b164-74a413a6f779", "value": "T13A14981E6E228F7DF268C73047F74E25976923D627E1D684E2ACC1105E6438E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762047420, "uuid": "3b8a79f5-c1dd-45b8-8eb8-ba53d5e1d422", "value": "3072:R3yprl1aO1WjWmX6JTHPMpTcJoFR2OHJwWI7tPXy:R3yIWfmX6yZ5AIwWOtfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762047420, "uuid": "ad9a64d1-4be5-4e30-84c5-b0e4fa799f0c", "value": 198684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762047420, "uuid": "d75f8429-2bd4-48f5-bc89-0e3efa2583d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762047420, "uuid": "d1044e34-832c-41c6-9d13-56fa128f719c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb36091-b803-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762098474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098474, "uuid": "6958c9a3-85a3-4a68-905f-d0170da35ece", "comment": "Malware payload (Mirai)", "value": "cf759c943c82070379092b6ab8562ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098474, "uuid": "6cc53db5-52b0-4d6f-a24b-06c455f27a8f", "comment": "Malware payload (Mirai)", "value": "68a69618c100594655945e7a1dbed1cf1571825e21b55e6aef1003bd0cf56c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098474, "uuid": "da29852a-68f2-498c-8018-55f49ce14578", "comment": "Malware payload (Mirai)", "value": "278d90908c93a3863564364ef72fef39fed74273", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098474, "uuid": "5bb9b50c-f78a-441b-adf7-468b3cb7c0a5", "comment": "Malware payload (Mirai)", "value": "0076a63b5fb8b6b0a456d4c80823ae1e37df69580564524054ef2f26d509b0255fd45214f9e41c3ce301bee1dc4fe336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098474, "uuid": "d5ab2523-3433-49fb-b54b-3d90b2664247", "value": "T124D32B86B643DAF3D8870BB416B3AB314A32F87A1B1FD642F32CFDB119416C4B509658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098474, "uuid": "f6f60f4a-7366-4739-ac30-7c95aacf0299", "value": "3072:6SpXTdqzKPzrGC88GDV8O2ylRWt9DDom2+3:6SZdUKrrGC888PSDDom2+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762098474, "uuid": "9cbf92be-c8cc-4498-b379-76b5358d73bc", "value": 139371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762098474, "uuid": "4346ce8e-870f-4cd8-b0d2-832c59b9ef2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098474, "uuid": "2e2309ca-8c03-416f-85bc-121bb582d75b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4f54c5-b7b5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762065221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065221, "uuid": "f958f4f3-6352-411d-aa53-9c13a4c6b34c", "comment": "Malware payload", "value": "79f2ac1d091a581d7cbb29b35e059926", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065221, "uuid": "5bd160e6-7b6c-4772-831e-7a7759eb0704", "comment": "Malware payload", "value": "693d43df2e7ab2fa7bc38fbb0f8add2307e840a63b4a5a8283efb0f3e98bc63b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065221, "uuid": "c6aff26c-5ec1-490b-92a7-e9a8aa7b34a9", "comment": "Malware payload", "value": "80b0b777ab88fbf234680cad027d13e5a077caa3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065221, "uuid": "96383147-0db8-4e86-ad18-3e2266b9f9b2", "comment": "Malware payload", "value": "2872e1158507e598d68a82e9e08257e3cb9c26f6af48d701749355e2442a25e2228ea1da04fd4cc7233fa12041be5510", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065221, "uuid": "90201a77-5aa9-449a-a68c-a4cd19f4db78", "value": "T11AC08CA2443CC472973A0A6EB251F1FC9E2BA4384FE039A2D42D8640B2344701C8F33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065221, "uuid": "46434f5b-c534-4aaf-ac14-68cdd2406525", "value": "3:pKWNFLIx8sv3uy9Fb+dNMftLHKW2EEtUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMftGWFebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762065221, "uuid": "e773cc10-014f-4e49-8522-fbae91ea1b1a", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762065221, "uuid": "636e7ef5-4f63-43e3-8feb-1416015d7167", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065221, "uuid": "05f4cb79-5c56-44f7-a717-5d313b19374b", "value": "w0nkvgf9kp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fddc1e-b809-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762101256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101256, "uuid": "61454ab8-13c6-4233-b061-673c6781e8a0", "comment": "Malware payload (Gafgyt)", "value": "75f95c291c2481f8b3018520b1784fa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101256, "uuid": "14f9f869-fe1e-403d-827e-951ca8ab9c50", "comment": "Malware payload (Gafgyt)", "value": "6984aa53d93a9523a4ebf50f217a8a9a7bf7be6b50003737a2f74861e54d83fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101256, "uuid": "b95d53dc-daa2-48a8-912f-3a58b9a15505", "comment": "Malware payload (Gafgyt)", "value": "065d2e3ade86132f5821cefb7749f741159f4841", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101256, "uuid": "9a47df69-5938-483b-8320-98a40692f008", "comment": "Malware payload (Gafgyt)", "value": "2541755988259e5819dd1aad5d998d5e58d3bbb30dc050ad0bd09277b0b08965f1681f5b8cac2e10b71f1a54c3268892", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101256, "uuid": "afb64806-2ebf-43a0-b516-d6558bd13eba", "value": "T148E3D837B2D18DEAC14252B016EFDEB29C32F1FE0772312B23A41D605F2E9D61D99A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101256, "uuid": "0c3bea59-6c1c-4fc7-813a-2ac5a091676b", "value": "3072:By5wC+/m+uWOJIAg66NLOACpha/+kYdlJm+QVOXFNqOPPe:w+xOIAl/pha2kYFm+QVOXFNqOPPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762101256, "uuid": "63521b2c-5660-4e14-bc77-70b627b50241", "value": 144121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762101256, "uuid": "0f7df1c0-c7f5-4ea5-a835-5b0c2357e6e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101256, "uuid": "80ce4bcc-faf9-4240-b962-1e4b5e89fa40", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4b9eb0-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103788, "uuid": "03b748a5-daef-4e47-b359-5e8399606d33", "comment": "Malware payload (Mirai)", "value": "2f207aca848f898267f2cf39eef5b0f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103788, "uuid": "74d14c43-45ff-4b88-bcd4-196117585273", "comment": "Malware payload (Mirai)", "value": "6acebdaf1998d5ddc684b18a81fbdda569f6f51af809be21ac721468ab26b2f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103788, "uuid": "61cf797a-8060-4d9b-8ccb-e30911077e4d", "comment": "Malware payload (Mirai)", "value": "11d41a375e8edd5852f8f9318a1099efd6722d49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103788, "uuid": "7cd6c8f9-1504-4aeb-a13b-517ce6dbe150", "comment": "Malware payload (Mirai)", "value": "760e13267e40c62a91a1537b9b3e397a807e3871d7801d955c9727378265f4f75af60f136fa65fb14a1a136a8e9c779d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103788, "uuid": "bc54125c-a9d4-4680-944f-cbc87b2c49e5", "value": "T1982309C8F443D9F9DC4A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103788, "uuid": "87951875-0ea2-4ed7-8fe2-d584f8e6b206", "value": "1536:6nJRT4QPfZfW5XTOeY3DveHAGX57/4Qw7bn2iae:Gv4QPfZfW5XTOeoszJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103788, "uuid": "4f70b2e2-98f4-4339-9a62-4df67af51f7c", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103788, "uuid": "87d13b0d-d91f-4b41-8515-cb0bc74ee180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103788, "uuid": "bfca6e11-c719-427f-b0f1-3d7b55869f51", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3502c97a-b809-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762101013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101013, "uuid": "5edc5175-80d2-45b9-b9c1-8c038769d254", "comment": "Malware payload (Mirai)", "value": "ece71d147ad1fd8938512cf034195bc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101013, "uuid": "51a38b63-0e71-4727-b897-80b7c3aad1ad", "comment": "Malware payload (Mirai)", "value": "6d36a432aa0165f19b64365eb1339c9ad2593d2fb49db18581654042f67390bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101013, "uuid": "ce0a4e3e-cf90-4bbc-a570-08623d659531", "comment": "Malware payload (Mirai)", "value": "ecbbd42caee600b87a2ca2daa1b4c8b0eb4c0507", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101013, "uuid": "eb703210-092a-4840-b728-872a0246be8f", "comment": "Malware payload (Mirai)", "value": "1a4985be0044fa5658905a496af28005c0d567dba56641c868604044769eb9f7f1466ef5ef36c75f2fa6a339455699b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101013, "uuid": "7605333b-131d-4072-83e0-b0163487c6b4", "value": "T17CA31895BC829A17CAD4137AFA1E42CD331623E8E2DE7213CE255F2137CB55B0E3A552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101013, "uuid": "17757037-6f8a-4061-9cf1-3a125592cab6", "value": "1536:XkLsuKL3D8L3SqhwPf7Vh8YZldcpjDmJpvlIhDjwA4pdzV2RwpY1/w3vjDC:XkPKTDC3RhwPf7nZlMyr1V2O2ojDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762101013, "uuid": "5ca7e141-66ec-4ad8-b655-52286ec3ffbc", "value": 103908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762101013, "uuid": "9382e11b-eb6f-4b9f-8437-56b5f688172e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101013, "uuid": "ed6fa246-6952-4322-a4f2-b71cba6e5ed8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30e7d9d-b7e1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762084125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084125, "uuid": "0799673f-d919-40e7-bd9a-4eb4cffd7e98", "comment": "Malware payload (Mirai)", "value": "3ee05a361a95f360b7b7a7c85f755889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084125, "uuid": "57a41593-7a7c-49e8-9d55-d2aa06302694", "comment": "Malware payload (Mirai)", "value": "6ef5045ee664fc8636492a5b5f7862e4d4627ada2ccc04b4f28d786a123e6ae1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084125, "uuid": "a7b06a18-58e9-4fb6-93f0-be08d56c7346", "comment": "Malware payload (Mirai)", "value": "66a4fae7f6e747f6dc9dd5563c7226ec50d91989", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084125, "uuid": "48be2a28-31a1-42a6-99c4-946785aa7640", "comment": "Malware payload (Mirai)", "value": "362b1a80b4330372b843e191a9a611928863d814d8d2ab6aa13563f441a476468b37ed7de17e8cbafe8dff2a302f674a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084125, "uuid": "c6fbb295-bb91-4199-a930-9ad21c94f854", "value": "T15CB38DA47A4F7D92E3C7E37DCE444A63711B75F5C26182B4BE22432DC4E69AD8AF0502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084125, "uuid": "10405c0d-8971-4b93-884e-30bf5cf5746c", "value": "1536:AY0ZGg1dFt324r0nCJA8E1160hp/P7re4+dFjgSxZlceuW:Xc5PF8zCJA8EH6WHJ+w8ZWeuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762084125, "uuid": "deffa91d-9bae-47f9-a3db-db165d24e70b", "value": 116568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762084125, "uuid": "dd259cf4-3bbf-4db8-a314-f52b1c98224a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084125, "uuid": "50b7ad70-712b-4a23-8a93-de115062898a", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d488b2a4-b7f3-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762091831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091831, "uuid": "ecba9658-2731-4edf-a01f-759009a39b87", "comment": "Malware payload (ACRStealer)", "value": "952c1bc470ed8523d2b14d71d1376855", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-175-223", "colour": "#B2DA2D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091831, "uuid": "df858699-2b23-47db-92cf-196c7b185b51", "comment": "Malware payload (ACRStealer)", "value": "712a608c472915663dd3712a7fbe33bdd1fe2781b7c44bdab77fccc7ac53cf3a", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-175-223", "colour": "#B2DA2D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091831, "uuid": "80509173-043f-46d5-a5b9-0b5139eff2bf", "comment": "Malware payload (ACRStealer)", "value": "e715c8e86552e95291027513319264fb72dfa902", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-175-223", "colour": "#B2DA2D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091831, "uuid": "524bcf1a-8da6-4c3d-9770-3cf2b293b18d", "comment": "Malware payload (ACRStealer)", "value": "237e2cef89b8d17c0a0279e7b9de1c07da78f51237d7709b28a6c63a7bc4e7b0719f8742d2e7e8f799f865f78aa0085c", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-62-175-223", "colour": "#B2DA2D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091831, "uuid": "72e68142-7a9c-4f09-a1f2-65250c714a93", "value": "T13418338F1450602BCA0261F084EE279A185256521EF1E7FFA3B96345B11B473F9EFE6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091831, "uuid": "40d549f8-4400-4d1d-804a-15c8a4a0cdbb", "value": "1572864:s7x3PtcPD3xVhIWtnZgOrTUNBadkwgRWrWt01HgXrDiMfuKzwhSCHqZj:SPtcPD3qW/3rw3kYRWjgXFfuuCiZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091831, "uuid": "00319418-5390-43c2-a75d-14768c8471de", "value": 88380625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091831, "uuid": "fc550c38-99e9-4298-a1f7-2b48febc64df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091831, "uuid": "35bd9dbd-3845-41b1-ad8b-07cdb200f7ff", "value": "Repacked_Full_Version.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb48adb-b7b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762065082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065082, "uuid": "ad8b958e-0697-4282-bc21-694714d2b6e2", "comment": "Malware payload (Mirai)", "value": "64f3f4e475493f82243b2d26ff842efb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065082, "uuid": "6d828762-24cf-47c3-9e4a-f930940c3fcd", "comment": "Malware payload (Mirai)", "value": "715f8621a104e0996f325bcf43160848c01682ae51aba2670a3c9052c2ea90dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065082, "uuid": "020c2bd1-8b4f-48f6-aa47-dacb41876274", "comment": "Malware payload (Mirai)", "value": "854b6a99358aacf01bc676ee22b70356b98591dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762065082, "uuid": "bcc1952f-bdab-441d-9bdd-ff7c6046cfbc", "comment": "Malware payload (Mirai)", "value": "9d18c959c0449c855f58af9b9ee6d5d23d55b5466cc9adf44766701f4e1f97b449a562f786d5957925733cbd7fda5670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065082, "uuid": "b81cc6ec-aa7f-471f-9564-6b7ce9119d06", "value": "T1DAE2E1727F050020E73476B9777EAEA93F97E948E7D306D283180A459E688013EF62D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065082, "uuid": "b9cb5949-da79-4de5-b649-df23791e60e0", "value": "768:cDj/6o3DYR6Wgvl2HmTQbT26T5dwtGL+8UgyX8DPjUQkdZ//:QP4Zgvl2Hfm6Yt3gyX8S1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762065082, "uuid": "5fa1205f-f1c3-49f2-9755-1b6c4792e69e", "value": 33620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762065082, "uuid": "aa5354e0-e847-419a-9481-b5b9efbe3f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762065082, "uuid": "d65abd36-b8e2-49a7-9fe0-a2af6cf52be7", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13db92d6-b7c6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072181, "uuid": "0622c341-1dd8-4b25-b8eb-7499a53a6005", "comment": "Malware payload (Mirai)", "value": "2283ba61957e16a38e3d6cb267edb316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072181, "uuid": "31593ea0-d27b-4125-bb7d-ea3aef0d8a37", "comment": "Malware payload (Mirai)", "value": "72ec3e91e09356ff2b92388895dec425ec97e2feea5e80b7ccab82e577f877b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072181, "uuid": "77c785d2-023c-40c0-b630-e2a5580820cb", "comment": "Malware payload (Mirai)", "value": "f0871c76e9f0fe017ba63a81c1c4bf41ff6d6405", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072181, "uuid": "d69e7bda-7f81-4beb-b610-f30e2c053910", "comment": "Malware payload (Mirai)", "value": "028aee7a84dbec7b8ac853245bed4c506f4f27976609f2896179d656bf0f81d63b1312edd789023c31564e4702991dcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072181, "uuid": "d38cf39e-50c2-43e7-90dd-51ca91cf89d7", "value": "T171B2D0CEA098604ACD8E6CBF775EA2324F6861E466CE9B7D4350DCD872B8887704D0B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072181, "uuid": "5ce72994-c691-4591-94fb-dd0988d61f3c", "value": "768:cGrQlS07dEv0UXqUhvQE+CXfUIap9E7NgqZqUWvs:vQlS07FUXqIYSXlo4geqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072181, "uuid": "3024a5aa-f2c3-404c-8ba4-b59783a545a0", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072181, "uuid": "5a9e5216-022b-4cff-bf1b-032d04e53573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072181, "uuid": "8c35002d-7419-496a-8a7c-c5f5cd87eb5a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2420321f-b7f4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762091965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091965, "uuid": "554b63fd-e2e4-4934-b1e1-bc38ecb35461", "comment": "Malware payload (Rhadamanthys)", "value": "b054afcb817c0749d2e98150b25ce9bc", "object_relation": "md5", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091965, "uuid": "aa32fa4a-3c6a-480d-84df-6f63d1c1780e", "comment": "Malware payload (Rhadamanthys)", "value": "738210b7ab282c0a2357a333a6ce02d61fcc1f9c1ddb69d380c9fa9bee686cee", "object_relation": "sha256", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091965, "uuid": "6e5a34e6-56e2-4946-b250-3edac7e0582c", "comment": "Malware payload (Rhadamanthys)", "value": "a0ebb0eacef1e74597fb4f6009a0746b48c55d2a", "object_relation": "sha1", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091965, "uuid": "42c3e517-2532-453e-b07c-d1d05d1b0d60", "comment": "Malware payload (Rhadamanthys)", "value": "a7216161e6228daf6fd54e4c2aa9eab0e42eddf4d8f3617c3152884c260012d58620eef8b678ad350d39727018126ceb", "object_relation": "sha3-384", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091965, "uuid": "84991081-0d5b-4860-96dd-93767c9777dd", "value": "T18B75232DA3F025A3F8B6A73584F25253A431B5E25B6111FF22C9D4BC1D406E8A572F8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091965, "uuid": "c9562767-54df-4049-8bae-8ce8260777fd", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091965, "uuid": "a9b76b75-6930-4c7e-89bc-41e07eacd179", "value": "24576:ljDP7SzQut/Efc7X+E4P9zPGrnJQVfZ5U0E3WyFqqoilluMD664or6w7wYisDm6v:ljx0/Ef074P9ceBEmyZjD69bw7XBBoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091965, "uuid": "9a056653-18b1-462a-a888-ad2c092058c8", "value": 1642496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091965, "uuid": "af0d20aa-161c-40e5-8ea6-33e837eacb17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091965, "uuid": "e6077629-63f1-4480-887d-e0653799f521", "value": "\ud835\ude4e\ud835\ude40\ud835\ude4f\ud835\ude50\ud835\ude4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8a88a6-b7ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762061377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061377, "uuid": "677cf27b-1db5-467c-8379-404f07aceeb0", "comment": "Malware payload", "value": "33bf8890ad9c8468729bce6739f62d6d", "object_relation": "md5", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061377, "uuid": "19f6eb28-12d4-4c86-b6c5-a689db434614", "comment": "Malware payload", "value": "73aa9d51fbf811d2c758da45eab2d6ae78321388035894ebde07c9465c331556", "object_relation": "sha256", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061377, "uuid": "49bcd1b6-fa8b-4e7a-88c5-d215257bbac8", "comment": "Malware payload", "value": "7dee62f2a1c2d3f00c3f616c561e958fa7810f06", "object_relation": "sha1", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061377, "uuid": "72258a3c-34fd-4710-93a2-a85e78fa0877", "comment": "Malware payload", "value": "739ecf065fec169de0b7c6984be8aa7138f761c4583d444abab20acf156b344647202dee4bd727c18cd6e613aadff6f2", "object_relation": "sha3-384", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061377, "uuid": "6d35f407-cabc-49e0-ba97-a2d84344dde4", "value": "T1D7E5DF21263A53BCEA5E1BF75972C0B890D3C2653E47D363B20952A7A0D105FB2D1FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061377, "uuid": "1e43f061-083e-4129-b980-7cc2e6e0e488", "value": "39770296fcafe4936a881a0e68c28435", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061377, "uuid": "dead239f-3c60-4f56-adbd-05d7e857ce24", "value": "98304:zMCSR7Sf0qMPoSGSuVg/mYtZ5xcTwYiOjmq2pW+yoK15B:zMC27I0xCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762061377, "uuid": "745352ca-7d06-44c1-8c6a-237ef798605c", "value": 3188736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762061377, "uuid": "d0fc7ebf-3b11-436e-9b3b-ad360141078a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061377, "uuid": "6dd62593-a4af-48f1-8d61-1bc210f5189a", "value": "73aa9d51fbf811d2c758da45eab2d6ae78321388035894ebde07c9465c331556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26263de3-b7aa-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762060186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762060186, "uuid": "69e97650-05c4-43ed-8fb0-732fcd8543d6", "comment": "Malware payload (Mirai)", "value": "f5724c20e036c51d9b71e38fee445b56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762060186, "uuid": "e76f6649-0ca5-40ba-99c7-0a7e3886ed5e", "comment": "Malware payload (Mirai)", "value": "7443574df3040abc52dd8d4aea21cd5fb772f9c556469b5ba44114eaa3375423", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762060186, "uuid": "27eedf9e-64e2-461f-b51a-07488fdc4f97", "comment": "Malware payload (Mirai)", "value": "34b87c0b43e3a3986351dc426597b27b339c63b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762060186, "uuid": "8c482903-47b0-4758-8593-e5a447bf87ba", "comment": "Malware payload (Mirai)", "value": "c62c71baddd628862f0bde68a06707599d06eda8fd27826e1138aed3ce677532a4e0b5bfbcd8f9351f300845523d832e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762060186, "uuid": "47086b2a-2bb5-4a89-b508-54d29b147e5d", "value": "T13F731996BC815B15C5D412BAFA2E018E33131B7CE3DE73129D215F247BC696B0E7BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762060186, "uuid": "261f7424-3c56-42bd-b938-cf34ddd5d6ae", "value": "1536:kpnl/NMwOjfWBKZneGPSQKh8Rf7GAzLBg0mIJ5fK0ra0nRqWr7xQipPaMEcJ9Yjc:6OjfReXvCRzZJdK0rawjaMEcJ9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762060186, "uuid": "d4e013ad-1ddc-4b0d-802d-ab13c2f819b7", "value": 79576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762060186, "uuid": "08b82731-015c-4d96-9743-45eed02f3f28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762060186, "uuid": "81e808d8-1c3d-4f9a-9f19-4223393acb7c", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b78518-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072070, "uuid": "c6053bf3-1619-4d2d-9433-c80604d7205f", "comment": "Malware payload (Mirai)", "value": "4c351e1f2c87ba85c9c1f8f0aa7a2141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072070, "uuid": "bdbb1892-9fc1-4470-a3af-04cc5cbc989a", "comment": "Malware payload (Mirai)", "value": "74530b9b5a3aaf69de04546efb73148a5c002f1b067909e8fa8d5e0443cb6dea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072070, "uuid": "27027c6d-10c2-4ae0-85b6-1ddbf7046cee", "comment": "Malware payload (Mirai)", "value": "6b607736a4f0839e1e4214635c2c3c8d47922974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072070, "uuid": "3e0a6d22-a88f-48ab-9c3e-80b9d4b2a57d", "comment": "Malware payload (Mirai)", "value": "76721ed3711b8c43209244c1bb268de79e306a61daa2d7df8d2ef8d17c502d5532749f6277970d42ba2bc181a5db0f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072070, "uuid": "2d2f82c5-c471-4923-a7b5-3b5d5d4bff3e", "value": "T1A0C36B46FA418F13C0D61779B6EF42493322A79193DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072070, "uuid": "609e41c0-790d-4239-98af-91077ac62c8d", "value": "3072:Fkw/uwypttv7yKg1styKUulTJz2oCrScxM/92Avbik:Fkw/uwypttvng1styKNlTh/CrSyM/9vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072070, "uuid": "c03e1e31-c962-4f0a-8582-ce85a7c2efbf", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072070, "uuid": "af237b4a-713e-4809-bc47-36c5137c9a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072070, "uuid": "15512311-0729-4d45-8719-64ed782a10bb", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5a2f71-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095175, "uuid": "ffe481c8-29b0-4c73-8265-057f8a4a0bc5", "comment": "Malware payload (Mirai)", "value": "ef40532b82db3bccfd1c74bb3a4df2c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095175, "uuid": "3ec60a50-6435-4053-ae57-8b2d282aa9d7", "comment": "Malware payload (Mirai)", "value": "7493565de036353bff63e86f48e813f9ee727532e4eafc99ef8a18f8899b3e5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095175, "uuid": "62d018c6-979b-4280-bfc8-066f88cfcd10", "comment": "Malware payload (Mirai)", "value": "5c33f109deb7e8c50ab269adaf34b6a16f8aa182", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095175, "uuid": "37f8848b-bd2e-490f-93c1-881415e2936c", "comment": "Malware payload (Mirai)", "value": "8a1031af3adaa36069eb5e7c80970c2207ec192568630eb1b520382ccb2981fa8d2aa55741821548f986aa54eb4e255a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095175, "uuid": "9ad45098-4657-4d72-aa51-e61392a49fa0", "value": "T1B3030203D456A8C5D8A884F2DA67808139915BE0F4F973935750CAE5BC7A4DB34F4F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095175, "uuid": "aa47cf5a-f005-441a-a1d0-939924b86089", "value": "768:ZWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ5+ItDxK9q3UELyT:ZWXasPGxplekBgTP654QwGtDtL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095175, "uuid": "80ef6edf-f7c1-4fd7-b972-bd27e3b9b83c", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095175, "uuid": "3346d490-65f0-43b3-93f5-698726fce0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095175, "uuid": "bb856eda-6b73-4c04-85d9-1dbf99b2147c", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bc2799-b7f4-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762092078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092078, "uuid": "c68102f0-6512-4ab4-ad9c-10250f7eb549", "comment": "Malware payload (RemcosRAT)", "value": "d93898034c9a47eca4f378f9b4ab55c3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092078, "uuid": "9c6556b9-7149-43c0-85c9-12f7b47a028b", "comment": "Malware payload (RemcosRAT)", "value": "749a89f97be237d1f4d2d417cd894cda7828117835f5f7a876028fac95bf8f82", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092078, "uuid": "b2ce5200-41b4-4c6d-b684-d77deb7a3a35", "comment": "Malware payload (RemcosRAT)", "value": "b543af26b0743adc15d48167580e8d1e298a3847", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092078, "uuid": "192481c7-aec6-4f74-8a07-1ede8a83777f", "comment": "Malware payload (RemcosRAT)", "value": "4fc813dcbcb239897594c4761b88e99dbd75cd642bdb02cb0a425ad9ae13ec9bdbe6ddf1af673a1f09782d9a3efb6dc7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092078, "uuid": "39e04a4b-8c9e-4141-8313-87aabc793d49", "value": "T17B815C00CC6C10F168EC1A341439A9900FF1368F19398BD5794E26AEDBD3DF46925702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092078, "uuid": "9f857b7d-b898-4ebe-b740-3aca9281f5c1", "value": "48:9ZBYvf5368nNFUpvTOqXMpu6PaPE5+to+GT3H2AWsm+PVVt9yxbnm8zNZBd/BM4v:d8NFyq6z6PantOTGCTyxLmAmC///nj8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762092078, "uuid": "8787c3ca-ea33-4cc1-b6bb-642c3b163f07", "value": 4047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762092078, "uuid": "4bb866e2-d5c6-4888-8d25-69789323cfbd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092078, "uuid": "958e7b0b-63b3-46e4-8e29-3cfb1757f5f4", "value": "n2025-D1-05181_Nolu_Diib-Revize_xlx.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54432396-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095052, "uuid": "d178f3df-c0ac-4068-9238-e959e0187177", "comment": "Malware payload (Mirai)", "value": "d5d638e9b9317febe47f307838c3212b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095052, "uuid": "fe67813f-f9db-418b-a644-0331b39418d5", "comment": "Malware payload (Mirai)", "value": "7604b2164d5dd1cf105fd5d9e72bab89ed8f56f21e578c314cbdc105631e20dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095052, "uuid": "cf4fcf1f-dabd-49b8-b1bd-e513629b83cb", "comment": "Malware payload (Mirai)", "value": "b7959a660c2da31769c8e9e9d9ea19845f6cc61c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095052, "uuid": "0fbd8068-dec2-45b6-bf52-4c023651daed", "comment": "Malware payload (Mirai)", "value": "274e4a12e971f06a65fcc052e649f4aaa1a6c13d14345c71e48f6c0681c2668949889fe09030930126e5d50998fc66b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095052, "uuid": "fa1e4462-2e09-4718-b60e-469ce3d444a4", "value": "T16D639E16D82509A9C286C5B471EC8E3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095052, "uuid": "17d7ccaf-7023-4228-a386-c9a92e4dc53b", "value": "1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8udX:DYkwfCFlugsz9xznsxrdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095052, "uuid": "b9a6fac2-1460-4de1-9e12-19839bc0687d", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095052, "uuid": "65fc64fc-802f-4574-8294-bda7545ff7d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095052, "uuid": "07fef6b8-98da-4eca-8777-0346a4221a05", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35496909-b801-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762097577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097577, "uuid": "1186fd11-5e55-4ed6-a9ed-4de5809e8bc8", "comment": "Malware payload", "value": "1f384ed24caeba8444fa54cf411a4d36", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097577, "uuid": "6e081738-31ac-4135-9148-71d6aef5eeed", "comment": "Malware payload", "value": "76bad9d18efdc2fcaac1f8b32d1d34e3c05577f80d85cc6ae453e3e887bc4260", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097577, "uuid": "1e46557a-83cc-479b-ac8a-6708dc9d1ab9", "comment": "Malware payload", "value": "ee7de2b7e05376fa42b2581781b4173a027a829c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097577, "uuid": "9805d5dc-6b59-43f4-88ea-d0ac4e29a331", "comment": "Malware payload", "value": "edb55a53a7c7b4441c1f09222e168b3e100445d99aa308dcaa155fd2587309a5e0e21297688dfbb09f1b23c785b99ffb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097577, "uuid": "905d2ee5-189a-4d4b-aa74-f18769b8cb20", "value": "T1F6C0129705512780418CFA7E76BB062E504193C4221787ADFCD800368188814B021A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097577, "uuid": "2c6bb09f-f1a6-458f-9453-390e9a0e0dac", "value": "3:zBMXBgHrwVoyGjhLEgWMV7GBzSEyLTUWRINSXhLEgWVaBzSE8eUs5oIj:tfLwVIjhiMVCItXhiod3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762097577, "uuid": "88cbf510-b90a-44f6-8860-fa861adcde76", "value": 171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762097577, "uuid": "e2ca1ba4-54b6-42a7-b3b9-f20d7aa6330b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097577, "uuid": "a4b5f28d-0a4a-4f99-aafd-5bfa0926120a", "value": "sm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2f9ddb-b807-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762100166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100166, "uuid": "e73af67b-9330-48fa-aad1-1e37c2ed302b", "comment": "Malware payload", "value": "162bf0dbfde33df722ee952dc9c73155", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100166, "uuid": "cfa3df07-8f35-4a1b-936d-c6b15fe1cb74", "comment": "Malware payload", "value": "76cb047623f8b366cd1d6c949c30a9ef394bd6a9337b97afbb2ea5b9fffb5fc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100166, "uuid": "d6a38c38-3621-4de9-b485-45a194f1dcbd", "comment": "Malware payload", "value": "e7af651f92828aaf12570f3afb1782fb1e851a06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100166, "uuid": "72d94d22-2f11-442b-a0b2-51d040583112", "comment": "Malware payload", "value": "b951c5da2f42ad239f3085d459a4fe32e506a462ee4d516c597d9111e8cefcb6d28d18514a3f2216d34d5e032cc47f41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100166, "uuid": "e1670fb5-7858-4d4c-81ce-75fca506aff0", "value": "T143B30756BCC29B06C6C512BAFE1E118E331327BCE3DE7213DD246F21378A55B0A7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100166, "uuid": "8b92bffe-d076-492f-b218-0419bc8f9edb", "value": "3072:xG3hCwJ5tpOT99aSKwWPTT2sojaCtapDnhkDh:xG3owJ5tpOTzaSKwWPTysOaaUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100166, "uuid": "42b8a7de-5377-4439-a499-8370d5717e88", "value": 112100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100166, "uuid": "2958b3f0-e594-4f63-be9f-1ee7f86bd775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100166, "uuid": "a834b4d3-9fe2-44f6-b727-616e4e679a43", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e041f9-b7dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762081846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081846, "uuid": "824779c0-23cb-4f36-aaa1-c14f4c39c692", "comment": "Malware payload (Gafgyt)", "value": "2d38c04b81b504e518e99c83850cf8f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081846, "uuid": "b5e5787d-eb5d-4a43-ba2a-2d33229f45a3", "comment": "Malware payload (Gafgyt)", "value": "76cd9f11b80ef1965dbcc0f5a291128a42765eea1f5249072453745c0ec3208f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081846, "uuid": "3ee0422f-30fc-46b7-8141-5ad26b3c2b46", "comment": "Malware payload (Gafgyt)", "value": "bab1e5954298b1fa0e8ea110283214f77a24d292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081846, "uuid": "bee18372-da29-4863-8628-9bc2d33c4486", "comment": "Malware payload (Gafgyt)", "value": "f60170f42c675a4bab051a298a480c3d518b6ee0dbc5f0e9b05911b694d6a487aa27f037d0f5be2d88403a06157cce5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081846, "uuid": "f86749a8-d4c6-4902-ba80-f208a1b0fafe", "value": "T189C319F9E307C6F3C40316F2125BEAA71D21B2BB1A6AA945E3282D70DF734C62555F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081846, "uuid": "7b5fb3a4-560a-43fa-9849-dae8c46b03cc", "value": "3072:RdSZiUTaxLEpOXzkWhcf35hT+iFmJC0OzQaGyPZk:RW6cf35hT+iFmJC0OzQaGyPZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762081846, "uuid": "36d8577c-9040-4b7a-bff1-30f104ec96a1", "value": 127460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762081846, "uuid": "cd4ea94b-ad15-40df-af62-b7fa1efb4bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081846, "uuid": "4359f845-b56c-444a-9c52-406fade5bdb6", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e65df4-b845-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1762127109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127109, "uuid": "b5fa9177-5bb7-4137-b02d-2e38e607a848", "comment": "Malware payload (DCRat)", "value": "fdc5b09cf1c88f78c278f81480012607", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127109, "uuid": "5d76a9fd-08b7-4967-ae59-be3ed82ca7d6", "comment": "Malware payload (DCRat)", "value": "77693f6d2956f9e626381e1228732a454fca3bd2a39c8247898e627bb427e12d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127109, "uuid": "12b7fd16-d5e8-4ed3-a554-4847ae914b3f", "comment": "Malware payload (DCRat)", "value": "9a1261d05c7a5e66844e5d6904a41c944b6103d7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762127109, "uuid": "5ae39a83-330f-44b5-8ae7-1ce43c91bde4", "comment": "Malware payload (DCRat)", "value": "9f0ded506bb71cab0f13363d1179ae64b9ac7cb1c4105ce244000ce6c7f5cd014a6c62da1ae50fc401cd96a2ca6e044d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127109, "uuid": "490de5c6-b614-40eb-8075-bbeae1f20fff", "value": "T15595AF0655E25E3BC2741B714497003E4295D73A39B2EB5B3A1F60E2A8037B5CF762BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127109, "uuid": "beffb2f3-3eee-4c05-8790-631fd50feeac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127109, "uuid": "0f17e518-ae0e-4933-9372-8ef8a0dfcc64", "value": "24576:30US5djN7js5j63pzwXDdk8zdKFJuMc2aAIHtTOY7SrbpOsZan:k9xWpHUcsINTkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762127109, "uuid": "08bdc341-deef-403f-9e1a-00aeb68e92db", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762127109, "uuid": "ff9048e4-c96f-4aaf-a8c5-6f048041dacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762127109, "uuid": "02ab5f7b-6eb4-413c-b67e-d6d0d4da9659", "value": "FDC5B09CF1C88F78C278F81480012607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a215d80c-b7ed-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1762089170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762089170, "uuid": "b88664ea-4891-49b8-85cc-ee8ec7422212", "comment": "Malware payload (SalatStealer)", "value": "7a3e8b386d3d7887c8a694223463a218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762089170, "uuid": "2594b732-7694-4ba8-88c3-660e8245df2a", "comment": "Malware payload (SalatStealer)", "value": "78bc9783c357731a8c4ec901b8bcf186100ddf79c19358a9a19ab8c9bdad1738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762089170, "uuid": "6e5869e0-e14f-477a-b788-ac20a1f14c8b", "comment": "Malware payload (SalatStealer)", "value": "493ee18fdfa93245990d7a1cdedbe774da263701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762089170, "uuid": "ce9eb0c2-9415-4d68-9e9f-102b276e205c", "comment": "Malware payload (SalatStealer)", "value": "202151e04fde815f06b123d11abb8de87e8b7c2ad77465a65656d44f9fd4d94fbdf7751edf04e54f78fd78544c6bfbb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762089170, "uuid": "6080b2be-4ef1-44e8-a326-8c8b1c0caf0f", "value": "T1FFC65A01FA8B64F1E9075931416BB23F23305C048B28DBE7EB587E6AFC776A11936749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762089170, "uuid": "e1bb2d91-08eb-4f06-9c38-784c4e41e007", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762089170, "uuid": "28d2bec8-9e67-4c24-a787-38e3e60bbd71", "value": "98304:Zr/679F+guv/PB6hyTxOgdFDDuBzdEXQbzI:i9OBeuFDDuJOXQbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762089170, "uuid": "b3743fe6-c0ae-4319-b48b-c13cc3279f71", "value": 12470272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762089170, "uuid": "b5bd6cc0-c00f-46bd-af42-782e7187382a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762089170, "uuid": "f704b659-5d31-47ae-be27-f8622ef9d97c", "value": "DiscordFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de52655-b7ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762096867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096867, "uuid": "e63edd86-d94a-4fee-8b73-9d2c4c78001e", "comment": "Malware payload (Gafgyt)", "value": "0744380f815a8fd8dd1a20e9007dbbb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096867, "uuid": "462dfd79-d18c-4583-8faf-4707db852cc7", "comment": "Malware payload (Gafgyt)", "value": "7a145aec20e0d6c25ec3f6163a4d70b00ad89854051d2680565785f46746d500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096867, "uuid": "f790b9f4-6344-4c92-b3f2-a19adf8e69fe", "comment": "Malware payload (Gafgyt)", "value": "7e385eeff31d3e29f82f176e2522b476aebcdede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096867, "uuid": "137ac18d-31e6-4dfb-83f4-cfeb5c77ddbe", "comment": "Malware payload (Gafgyt)", "value": "0b16fe683d6ec476d8258da862d5333862d8774e8222c02c22f72eb0ffd888569fd7c72d76f02f50d4a0aff4fa6d6bc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096867, "uuid": "5e8fc94b-1ce2-421d-b310-175586e95e4b", "value": "T11DF3B63BBB170F23C0C500B111E76632ADA5C7D634F952D76AE06DAC6F2A58834A5EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096867, "uuid": "91fa37cf-d3a2-41ca-a27d-46e0d2e887cb", "value": "3072:QCVjpvluN8A4phavm16upfbTsmzjEq/dNYy2Se:u+rpha+16affsmzjEq/dNYy2Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096867, "uuid": "81c1439d-882a-44e9-be9b-df49c4a33d6d", "value": 157989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096867, "uuid": "0875921b-cae9-4df6-8d50-13e6f1f99fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096867, "uuid": "3054053a-1b36-4d79-a288-e822d05b3bed", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55915e1a-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095054, "uuid": "94a2f706-e2e0-4f14-8929-67231e5eb3bd", "comment": "Malware payload (Mirai)", "value": "8c3a27ead5859f18ed8deccec5d7d4e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095054, "uuid": "d9c06481-00da-4d64-94a4-29cb1b5a8dae", "comment": "Malware payload (Mirai)", "value": "7a6cf4acad516547d3f63b79d99e1f0a9f3e00a9a71eb148b3ec0cd0e4a16cdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095054, "uuid": "b693cc3c-76a9-486a-b9dd-22c2da4f1a7e", "comment": "Malware payload (Mirai)", "value": "0826c841718c1f681e0717b84baecf25e12b64d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095054, "uuid": "b10e1372-bba7-4f8a-abc7-874008b6ee96", "comment": "Malware payload (Mirai)", "value": "bdbe431dfd6177dd8ee5329995791c918a2cb50fda2da04bceafb8b34f549154340201e0fd4b5e489bf77b2893e65e08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095054, "uuid": "7d5dd493-427e-44fa-af60-4df8433bc34e", "value": "T1BDF2F25522C96073C1E86C73DC7087F12D2B01BAD4E833D19FB58398E256615A97BEE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095054, "uuid": "f5c83723-7601-4f80-bd92-220440d4368b", "value": "768:CrFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6G/kEf68/uis3Uoz1:C/eRSnQjMgVuP7qtqxgtAsvyz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095054, "uuid": "2652d677-2b72-4f45-ae20-603643be24d4", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095054, "uuid": "31fd635b-9955-4339-a7c3-9711f7af02a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095054, "uuid": "bb1e2989-9430-49be-8ec5-1d52ddd91408", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ba6818-b7f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762091047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091047, "uuid": "a2e6dfd1-4275-4344-a05d-35d6f1681d6f", "comment": "Malware payload (ACRStealer)", "value": "22f51ea5ea2ac24b7c0cdeb64c7be65c", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-224-18-100", "colour": "#2E6EB1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091047, "uuid": "209d8ba7-7a85-4952-9813-1fe0fbd677e8", "comment": "Malware payload (ACRStealer)", "value": "7b283ecf9408f74901f338086171910cdfce50e819b94d309dd14ad9d5da0e3e", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-224-18-100", "colour": "#2E6EB1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091047, "uuid": "4017828a-7eca-435c-abe2-ac0148de11f0", "comment": "Malware payload (ACRStealer)", "value": "cb0f9eda84288c90b4fd0c599b9a326c07fa4d11", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-224-18-100", "colour": "#2E6EB1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091047, "uuid": "111976ef-7053-49a8-8877-1bf6d595196b", "comment": "Malware payload (ACRStealer)", "value": "7f4406221458376ba05e5a8166f7910e746027ffeb8f990793d1b18e14a389649e33961ea56666edf305e7971642b55c", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "46-224-18-100", "colour": "#2E6EB1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091047, "uuid": "7df511ce-018f-4734-94f1-df95813a4cf4", "value": "T12A6733CCF155EBF5B2318272996FEE4B3C687A765044DD3C38314A9B99AF2C41410ABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091047, "uuid": "f3599ad5-a315-43e5-8203-63621014af13", "value": "786432:cxPDb9XUt9OOXDEf+MeKzmrhSsIi6+C2dvwWWx3mzIzF+tTwh:8XCDa+MDyIyLoVmzAFgTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091047, "uuid": "583fb141-54f0-49fa-91a0-a1cf167f4947", "value": 30351174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091047, "uuid": "1f6acba0-324b-45a7-a6c9-8d5c6619e4ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091047, "uuid": "8bcd4e3f-88a6-4514-a787-be5bbfc07de6", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a22777-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074254, "uuid": "1d7485a6-0811-42cd-a44c-dc0c3aac2951", "comment": "Malware payload (Mirai)", "value": "2e678e0e3b207e6f99122232ad996b2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074254, "uuid": "1a46134c-f855-48c6-8d9e-b452b694c303", "comment": "Malware payload (Mirai)", "value": "7d26b834f7a16119151a04ea247d1dd72c28290ddb14d0b653d9e942d919af44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074254, "uuid": "be929e07-284c-40fd-8b66-d24a1bb00419", "comment": "Malware payload (Mirai)", "value": "732030121f6646c0c4a8d4906444551d7ea301ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074254, "uuid": "f6ed335d-0c61-4686-a788-3a463feb013e", "comment": "Malware payload (Mirai)", "value": "66770047bc8c96ad64ec6bcf49310abfbbdeefe877ee38f12a21498c594c221d9aeda35cf4a422196a9f20dcf979a8b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074254, "uuid": "434b18fe-4584-4fcb-838f-cf80aa2b6ecc", "value": "T11B13F1BC20415493E68742B423F613BAB7FF21E7D040AC2696ECC586BCDB5593963BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074254, "uuid": "576a3acc-578e-4839-9c18-3bb90f9271dc", "value": "768:Do0FW/Pmn8EjYQeT4nt97WwDxQbXsV8VwKNHZCAKiJgGlzDpbuR1Jo:Do0U/PmUHEXhagVmLCWVJua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074254, "uuid": "1f6d15b5-110e-4bf8-8c92-105682361deb", "value": 43396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074254, "uuid": "0c19dbb4-fc11-4d79-8508-71663e44ba59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074254, "uuid": "f06d4f52-eeeb-4b4b-a1c6-634b99b5ebfe", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755b9d3e-b805-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762099403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762099403, "uuid": "4d0950bc-320a-4313-811d-73b3179985e4", "comment": "Malware payload (Mirai)", "value": "5f3b41d4d031f42e6b14097126f46804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762099403, "uuid": "97f37df3-ecfa-49be-becf-804b1997b8cb", "comment": "Malware payload (Mirai)", "value": "7d65444d46e5360c18eebd23cffd6d1b86778a0eccbcb8a07761eb00121a3849", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762099403, "uuid": "19fdc750-7e28-4852-a7ff-eb85aefa3f1c", "comment": "Malware payload (Mirai)", "value": "7e5061765df5508a62ebd78a91ff5e90192ad942", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762099403, "uuid": "5879c780-285a-4b63-aef0-e63993fa6193", "comment": "Malware payload (Mirai)", "value": "febc5021065481ea6a559830f10860a324843c82b854cb1625ee980f4173a19d2a438139477662738fced906f9f92cd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762099403, "uuid": "5958be60-aac0-4a75-bd32-788596911dbb", "value": "T169630234BB1834DEC354787EBCC143926B3197D8F28A793A153A8299B0E3265F5B854F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762099403, "uuid": "9c1fd541-4bb7-4a4f-bbd6-94fc3e7c46dd", "value": "1536:Ol6NNa2Fm/GevIPDJvBwIck264I6/4Fz401fQ8/pvVy:OKRk/GevoJvBwVk264D/Sk01fQ8/pvVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762099403, "uuid": "58eb9c20-5206-426f-a95c-c81fc21edb5d", "value": 70080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762099403, "uuid": "ff44f21e-5630-4a25-b7e0-8a6e0ccfbc19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762099403, "uuid": "48026ba6-e3e6-417a-9071-8cb835bfad2f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5898d5-b783-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762043764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043764, "uuid": "9b6605e1-43ec-4696-a8cd-76d8a4c4c0f5", "comment": "Malware payload (Mirai)", "value": "decc228ae61e8b0baf284b0e4a135039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043764, "uuid": "59a4f45f-da5b-4656-b387-026d7cbf8599", "comment": "Malware payload (Mirai)", "value": "82a0f06a61481c8547f3fd137f34fe7c3081710b58c70e411450045f9e621750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043764, "uuid": "5e5c8ff7-e3c4-4c1e-99c8-9f2f80e551a2", "comment": "Malware payload (Mirai)", "value": "3084381f67b5c1089087635ee5f3be6ce277df00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043764, "uuid": "81265501-f3dd-4544-84cf-f36b74cc6912", "comment": "Malware payload (Mirai)", "value": "51f164181c447aeccfd8031db11e70d99a70bc5f056d03791e4f13ac5761d48b85492f643207d6e9b48c3aceeac6cd62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762043764, "uuid": "946c05bc-7181-4f3c-b169-d28f87f395c6", "value": "T190733A22BD360D17C4C0A87A21F34765F1F6938A26ECCA1E7D620D4EBF646503197AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762043764, "uuid": "136afb7e-a4ea-4385-b927-762ab9d7cec2", "value": "1536:8KdjdVtjtIrLtQ4KCLHKVRo5xtkwuzt5NMUtB7wts:3JWK4iejE/NMNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762043764, "uuid": "154771e8-ee01-443d-b058-ffc0d7fded28", "value": 74900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762043764, "uuid": "785a3a5c-6f3c-4c38-bdbe-e765bf3d8865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762043764, "uuid": "bcca5b5a-4b3a-49f0-b1be-5a310727f4d5", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa2b059-b7fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1762096566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096566, "uuid": "3eaaff61-b667-4e59-bcdc-597bdd8fa43c", "comment": "Malware payload (RustyStealer)", "value": "82b286587dc923d49028fe2933f31bde", "object_relation": "md5", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096566, "uuid": "dd4aef0a-7c23-4a5e-a1b3-bde17f89222d", "comment": "Malware payload (RustyStealer)", "value": "8374773c1228695085a3d526c9bbc068aad17d0661511edaf218ac56e2ab6d1f", "object_relation": "sha256", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096566, "uuid": "cce4ee86-938e-4897-b307-f42302314c31", "comment": "Malware payload (RustyStealer)", "value": "54aab4bca8cd20ac72a9c11ced590254b050f48d", "object_relation": "sha1", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096566, "uuid": "930f07e6-fbf2-4fca-a916-478e5ffb0d2c", "comment": "Malware payload (RustyStealer)", "value": "d510f070672842e42055a5c0bfae5e5ed0fad70c2ddb4884a92ca3515e59b64882df78fa954dfe0b6380f274a6deb6ce", "object_relation": "sha3-384", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096566, "uuid": "a25388b3-47f8-449d-81d4-23dadfc43e5c", "value": "T146250102B6D18471D69640761D28D379973FDC000B15CEE747E09DABEEBE6F21A306BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096566, "uuid": "3b979102-ca0e-403d-9cf2-046e652a0f3c", "value": "dc63b0a1a3dde27ad9e35740290558e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096566, "uuid": "997648c5-c02a-40cc-92a0-86fa54fa1a68", "value": "12288:Oa/b6sg9XJXuoBdglwa7nBTZEjmbP/P16jYUiO4anNLt+KBfXFyBfCeCopgm0VMM:Oa/usCXuoDwTBAoQCOXN1I8L17EF9yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096566, "uuid": "f671f2bf-9132-49e5-8a41-f0c8c704067a", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096566, "uuid": "cc5340a3-0665-41d6-b9b0-d35f55930cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096566, "uuid": "e61ab8cd-21e8-459a-9fff-f3fbc03e5703", "value": "audiocofig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f9e6f2-b825-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762113144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762113144, "uuid": "9b3d48bc-3a5b-466c-a022-b86fde30a3ff", "comment": "Malware payload", "value": "a84af32ac9fc3d459a75c0c1f1dd1017", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762113144, "uuid": "1e684c22-5f76-4087-9f16-72d4a7b9512b", "comment": "Malware payload", "value": "864f41d231931ce8dda8dfef17c84106adab9d3d2023b5e41ddc403e79ea3461", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762113144, "uuid": "736c8e60-579c-4f5e-8874-9a633ff464da", "comment": "Malware payload", "value": "4b582ade0042b300d76d3fa7ccc72a5df4c1ea1a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762113144, "uuid": "44eb1a23-c7c6-4786-9ee2-277b053a5d59", "comment": "Malware payload", "value": "3652631ee2f37c61a7b80bb272e94a04857a996dc5e1688bb727c854ed483c2b6ed9148b03f11a798dfef35e37d52213", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762113144, "uuid": "126bdddf-60b5-4551-a1bb-5772f062c53e", "value": "T1F835F026B660BC9F4368737C92FA3A0721180EE2C5F546A893B21C51163FE7C9F57678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762113144, "uuid": "1685d846-b6a8-46d9-84f4-c4bbba08d1fd", "value": "12288:DEWupeh1xDe4SRAXMKK57AWsIWAeAaWyxkuPdzGCq/Yf2tDrFOlENqSCJylJc5M/:DEvJ45i58aWk1YP1qQOF5NlRtUBftSf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762113144, "uuid": "d90d25c7-54f3-4ed3-a7e4-f3ce329dadfe", "value": 1073955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762113144, "uuid": "3fe52b4f-5d30-4138-8562-d8b2a95deddf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762113144, "uuid": "57747ae2-45cd-4cc4-9890-7de325519726", "value": "ydsxvoz.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14858f36-b7c6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072182, "uuid": "1a1ed6ff-64a3-4bae-895f-c206dc5cce33", "comment": "Malware payload (Mirai)", "value": "8cccf7ab9692514aaf756b4ce990c583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072182, "uuid": "ac140ea5-88a6-406b-9cae-a202a5a2c327", "comment": "Malware payload (Mirai)", "value": "8706bdf12bc3b975707d1e2094d5c5c4188156136b9b92371e8a7fb4ae995754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072182, "uuid": "bbbe79c5-8c07-4ee1-b706-24ca6a1d414b", "comment": "Malware payload (Mirai)", "value": "a238b7dbe8f89bb47587d1b5431b4ae111025dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072182, "uuid": "3b5ba66a-f467-4775-bb5a-871c32b1f780", "comment": "Malware payload (Mirai)", "value": "7bbfa594babdf1a061b75bea58069e1ed0a60c4df3b42e96b7fc24c0b8418121ddbeb2a27242eac78aafc1b1404e5599", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072182, "uuid": "bce62745-8e41-4a75-9d19-29b4cdaab6cc", "value": "T1A5336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072182, "uuid": "4f1a4d13-4dcf-4f49-ba56-c33c9b55574e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9Cm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBbm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072182, "uuid": "143820c4-8a5c-4976-8c8c-b6837260f93a", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072182, "uuid": "2d112ef6-e375-48e2-b4ac-6b067c2778e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072182, "uuid": "7b43313d-82d4-4bb2-95da-c225fabc5f28", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82486de-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074282, "uuid": "27aeedba-ed01-4fec-a38e-ba73ae9422de", "comment": "Malware payload (Mirai)", "value": "d70c4898704061ff211132bb3cedba1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074282, "uuid": "de5321a7-b240-4ca0-baed-185e90283053", "comment": "Malware payload (Mirai)", "value": "89082dd673d0f246d8a848fb98b7c68d8e2743e0c8d058d201cb323cbd8c0903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074282, "uuid": "8f5b32ca-9a71-4437-ace2-13e987ee805a", "comment": "Malware payload (Mirai)", "value": "361810b7499b3fc436b8585fe7ede211997e8cd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074282, "uuid": "fd527e86-5cdf-4237-a0cd-8ac60f0b4f50", "comment": "Malware payload (Mirai)", "value": "8c6879b32a2b331a0ea17e71287adbb891e23886c1f2f506851334f2e7b22326e7fb3560cf2cbf10265138be7f880da4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074282, "uuid": "c8dbc55b-af6b-41fa-98f1-b219e148db38", "value": "T1DF932956F9818B22C5D512BAFA1E118D332317BCE3DE72129E205F247BC686B0E77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074282, "uuid": "e3a93f29-759c-4a08-99aa-311eb1fc5ba7", "value": "1536:YGn2Gk2GAbpzg2404eQFLXxH8mwyaIdG5sQzM1ihoXERaY7APx5xYJeCz:rk255g2KEmwyaIIoXERaYYxjoxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074282, "uuid": "10506239-a69f-4e7a-8c33-dd2a1263b085", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074282, "uuid": "af26bae4-852a-49f7-8337-197a729335be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074282, "uuid": "abe98a72-f1e1-4f90-9182-a4875f5faefe", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703143cf-b7fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1762096388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096388, "uuid": "26430b45-c91e-4720-b2ba-c2ad542b08ef", "comment": "Malware payload (RustyStealer)", "value": "74f0c36a71538d521613ad08870ad309", "object_relation": "md5", "Tag": [ { "name": "ChatGPTAtlas", "colour": "#086641", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096388, "uuid": "bc1d6d91-db7d-4c93-9f87-be5d5d443e6a", "comment": "Malware payload (RustyStealer)", "value": "89952a6dd64305cc5e134e216f5ffe363d8e9c9fc92e2b2434c7cce60229de12", "object_relation": "sha256", "Tag": [ { "name": "ChatGPTAtlas", "colour": "#086641", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096388, "uuid": "a2410128-5e64-40cf-8bd2-ca8420252ce5", "comment": "Malware payload (RustyStealer)", "value": "e04efc7beb92c8a5a259a5b654199424bd7f4fce", "object_relation": "sha1", "Tag": [ { "name": "ChatGPTAtlas", "colour": "#086641", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096388, "uuid": "c145babe-ff62-4172-ab38-c3d3bfc9daaa", "comment": "Malware payload (RustyStealer)", "value": "adaff68b21abb1e0c274482c5230879d80d1f6c50c3b557bb98dee3675a41d914b997b3fdab8b7daa3f60984dbb056bd", "object_relation": "sha3-384", "Tag": [ { "name": "ChatGPTAtlas", "colour": "#086641", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096388, "uuid": "69024243-8073-478d-806e-9294efe479e1", "value": "T109282347F1A612F4C12BC2B593165523EF72B458023A62BA92F886703F87B50D73FB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096388, "uuid": "e75d8585-d1b3-4017-b0f8-5a364ef9b0a3", "value": "01a702faea615deb8afd2e16c4beb983", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096388, "uuid": "8b86ecff-2f40-4ed4-a4fe-9e23615a7b3f", "value": "1572864:nEy7PX7ibWr0L/k71lMoRB9ktxBpo3MhBGUhXRS4XSJB4Gn0fXt8wrJtKz:Ey+Wr0L/kZzKxBi8hEUhBS4XOl0fXtJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096388, "uuid": "a89722f3-735e-47c8-8edb-8c85066f2a35", "value": 95244656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096388, "uuid": "26a4da18-7623-4f94-8db0-82e9e180bf10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096388, "uuid": "c848c062-83ec-42bc-a035-5b7116c6fce2", "value": "AtlasBrowser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0288e03-b828-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1762114507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762114507, "uuid": "3d860046-ed9f-427f-b10b-55f9065fb912", "comment": "Malware payload (DCRat)", "value": "7684a0394f078aafb246a0ab882fde89", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762114507, "uuid": "8d29f287-30e9-425c-b724-73026b7ed0a7", "comment": "Malware payload (DCRat)", "value": "8a430f25ff38968cf6b7e97afc3e05ab1a6c0602909ce10e2b5462ed549b28cb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762114507, "uuid": "8a71c32b-0b67-4d05-af4b-4fd4ae6e4cde", "comment": "Malware payload (DCRat)", "value": "ccd08eb5f8f29530d3acdeea9736b34623d6953c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762114507, "uuid": "c4218246-3113-4f6b-aaad-0d6600147d29", "comment": "Malware payload (DCRat)", "value": "6e2e6d8b4d46adef728ac960553dd25342be1051bf53b5b397aa814c677c909bed6f4079d386529c9e7932d5510e81da", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762114507, "uuid": "eefd295c-6fb3-4fab-8bca-4ded69082c94", "value": "T1F9A5AF1675D24E32C26457354697223D92B0E7323E52FB4B375F2092AD1BBF18B722B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762114507, "uuid": "1af04b11-aba5-4084-b10b-b1fa18dd2735", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762114507, "uuid": "badc7ddc-1e91-48b0-b1e1-c0e5a295e6f1", "value": "24576:2TbBv5rUyXV1ylaBiQO1297+EGcuj24VN6kCriQrl4T/zYw1/eIyY/q7jvurJbtA:IBJ1nBK1Ncw+nhpY/aurJ5drwTt90e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762114507, "uuid": "a0f6dc7a-275b-4f46-a940-5611e138657d", "value": 2239241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762114507, "uuid": "acecacbd-e4b0-4080-895b-b1a656e4603f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762114507, "uuid": "ad66df30-c7e0-4dff-b9e7-302b0aa475df", "value": "7684A0394F078AAFB246A0AB882FDE89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555199e7-b7e7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762086464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086464, "uuid": "a50dd360-f637-4fe1-88e1-131c4a591176", "comment": "Malware payload (Mirai)", "value": "fff25abb7bfe0ee4ae5e5e5497f341e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086464, "uuid": "7b3bc86e-4174-475e-84a8-9868928e7042", "comment": "Malware payload (Mirai)", "value": "8c813dea69693f23d82e38d7660ecffd209c529496b558f1e8d57586eadf5982", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086464, "uuid": "c9a1ca95-b8e7-4d7c-9853-1577e7cbe67d", "comment": "Malware payload (Mirai)", "value": "119f44540f824e2cd2bba424cdce8f8e6f685de6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086464, "uuid": "8f174378-157d-47d9-bce7-4e35b1371fb7", "comment": "Malware payload (Mirai)", "value": "f6794ac5c12d4dc00fb19d1b6c0bbadbc9a1895e601e953b3782e8d7461515c4650f3fbf0006fc52da684d9193fbc12e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086464, "uuid": "6231571e-bcbb-406c-8fc9-a0a225ab1d5e", "value": "T137733981BC819A13C6D5137BFA6E02CD372123E8D2DB3217DE219F2137C696B0D6BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086464, "uuid": "20dc6d55-4142-4cbc-9ad8-c28428926c01", "value": "1536:QnI1dycnoDuzc/P03TSSxkVq1EDSSjZ4rZv/C:QnI9mq19SNK/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762086464, "uuid": "4159a9b8-a344-489b-b0ba-dc98173c6c1a", "value": 75252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762086464, "uuid": "512848e3-4ef0-4f7b-8afa-bc2b64864d42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086464, "uuid": "ed45fd82-a27e-481b-b1db-c9b088ddd8ff", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c24d51-b7f3-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1762091485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091485, "uuid": "e380ceb7-f7d7-4ffa-8710-0dcc6308e04f", "comment": "Malware payload (LummaStealer)", "value": "7e2e25d774d97fb26863c0580b52fae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091485, "uuid": "1249a76e-6bce-492c-aff6-3ef50b5285e3", "comment": "Malware payload (LummaStealer)", "value": "8c89b3f15e462d64a51c14246c11cd23cc27733a630beb8372beb4c3c20ba519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091485, "uuid": "7b059df6-d5d3-49dc-9b8c-e6685ad95699", "comment": "Malware payload (LummaStealer)", "value": "fb6dc0cdbc140fa67abc85e5ba9e677a1e9c8503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091485, "uuid": "5485e067-f4e9-4b7a-aa49-c56e213f13ad", "comment": "Malware payload (LummaStealer)", "value": "52b8768fb0800b8ee3d3a061a08524db1d0825d18fb1e519e52b3e1b44cdcf891eacb729ce2f83c475d676e729018f3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091485, "uuid": "950902ff-42e5-4a3b-b311-49f9f0e06101", "value": "T105A56D066CD045E9C0AAE37589F266D23B39BC140B3273D72F94A3B92FB67C12636754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091485, "uuid": "fd2e94d1-ac10-47b1-978e-f14d85ee0c02", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091485, "uuid": "13434630-85ad-4a08-9dd5-f069ac1b5a1a", "value": "24576:rRwtsReTWEuoFb5fpDQ6sfD4tDTyzZuCGuWYxc+a+Rm:rRwtKmWED5xDQ6sfDzZuWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091485, "uuid": "416136a5-e980-4880-85d4-c36842ce6433", "value": 2198688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091485, "uuid": "a0ffbf3e-a668-4857-a8ea-71f8f2f40337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091485, "uuid": "a5aab0e9-dfe5-4584-be4c-ae3f02ba5eea", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076e8410-b7dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762081609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081609, "uuid": "5436087c-8122-4c44-ac15-2f600a176322", "comment": "Malware payload (Mirai)", "value": "c5fc9d22b466f47e802e8731e09c9610", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081609, "uuid": "2fc898a2-8e6e-4933-bef8-cf0cb371d7bd", "comment": "Malware payload (Mirai)", "value": "8f092314bb36d8c0dc18cb8b955ffe517daca4e5f7d4a0c5aaedd75aa94ea6bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081609, "uuid": "80f00d0e-8413-4c69-a3b5-0f06a2386ae0", "comment": "Malware payload (Mirai)", "value": "dc63099282d72de531d377892a5697aaa379f6b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081609, "uuid": "3e32b0c2-43d4-4ff9-8939-02f59370fae7", "comment": "Malware payload (Mirai)", "value": "925328fac67896c666b060d2ba4460eb61373e05400dc6a6c405f8df65d345a1ff21491eba3e0a4026abff883742727e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081609, "uuid": "1dd5a949-fef1-418f-bfc9-6121ac64cdd1", "value": "T195E2E1F3AAF8E063D2CFA5732C752CC8FA458F74D57501DB8C1849C94C35A1296B4B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081609, "uuid": "80280ed1-852a-4fb9-af34-122582602dd7", "value": "768:6ffjiH56FPepKq+Ym2pFvLVpWX3V4CRAYnxm9mrdydZ9:6ffeH5MepCGd8XGiir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762081609, "uuid": "f0887389-4eaf-4977-b467-ea378385ed92", "value": 33932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762081609, "uuid": "8df2b137-bb9b-4948-af14-fad6c36e0b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081609, "uuid": "f155799f-c654-4cf9-902e-77b5261aed8f", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb91723-b7fc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Blackmoon)", "timestamp": 1762095716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095716, "uuid": "17c6c3ec-13f1-4377-af72-1e95374fbac9", "comment": "Malware payload (Blackmoon)", "value": "39942a96ba3c3c3a509fa1a221adda6c", "object_relation": "md5", "Tag": [ { "name": "116-bei9-xyz", "colour": "#A9B70C", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095716, "uuid": "8e3423f7-af6d-4a01-988d-576e955d5c0c", "comment": "Malware payload (Blackmoon)", "value": "8fc47c0972e855f0866d9cf9cba29d56210fc709f13214e6ae6687ca40ca51b8", "object_relation": "sha256", "Tag": [ { "name": "116-bei9-xyz", "colour": "#A9B70C", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095716, "uuid": "19597878-c1a1-4fab-a3fd-892d7c254b24", "comment": "Malware payload (Blackmoon)", "value": "0935ae64c6961978f2465845527d3071966700c2", "object_relation": "sha1", "Tag": [ { "name": "116-bei9-xyz", "colour": "#A9B70C", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095716, "uuid": "fc9eb8bf-442e-4f0d-a65a-aa9e5e99e2fa", "comment": "Malware payload (Blackmoon)", "value": "05f95e84c768d3d01315b9572ffa2ff9cfba8cd244886e1fae69b80bf7cf83d1cfac4fc86c293d16616f13b5a5549a4c", "object_relation": "sha3-384", "Tag": [ { "name": "116-bei9-xyz", "colour": "#A9B70C", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095716, "uuid": "adfc43dc-9113-4b45-a819-4bef217827ca", "value": "T13707332663F54D38F6DB98312CFF026E3AA9F78B4F518404AD8D688C4B5915D2CB9723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095716, "uuid": "2cb20dde-a02f-43c4-97d3-a8e89336c754", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095716, "uuid": "3338e6b4-0b8f-4377-a90d-3bfcb7f10768", "value": "393216:l6smW5MMicChUOhyJGwJgKridsEKnncx6PzaUNDBpSejaWBu:l6g5MMhTO8rgKrCWncx6PzttpraT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095716, "uuid": "b2de0e5d-9f07-430c-a5ad-0230284aceec", "value": 17637842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095716, "uuid": "ff9a4650-2359-4623-84c4-e4a2cfb3728c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095716, "uuid": "a4f70b18-ecc4-40a8-8ee9-9cdcf76db800", "value": "kuailiansetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5848afc6-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095059, "uuid": "b3d8d993-520b-4f74-ad75-2b1ba929b335", "comment": "Malware payload (Mirai)", "value": "7e2dc0632b37b688aeb5b0b56b07948f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095059, "uuid": "12b5fcd4-8c79-4d73-98d4-7ae8eca268dd", "comment": "Malware payload (Mirai)", "value": "901f0ebbc68d65b08f81fe050bb08e76c976596109a8304acbb41b680dd3c697", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095059, "uuid": "b5270c07-699a-41f5-9cd5-7ce999f9a54b", "comment": "Malware payload (Mirai)", "value": "8acf15ea606a73d2891413dc32733c0042ea0b36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095059, "uuid": "1ac82465-c313-40ea-8088-8e0c07e84d9b", "comment": "Malware payload (Mirai)", "value": "6c11c9b11b6486db7da91e3f85e2dbcb0e772f4ae3328477b30f2824dce93d7f73f41a56074b7099255d612dfb517a21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095059, "uuid": "f9775301-3f88-47ce-a757-04cb2fe39c04", "value": "T1D4B3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095059, "uuid": "600204c8-e1d1-4e99-8642-d96ebb387396", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDa/LWW:8YSZ3e8ZE3MYlphDgDaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095059, "uuid": "68a7a9cb-5a92-4859-82a0-ba2f8335f761", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095059, "uuid": "c4065809-b9dd-4c45-9920-0ead0a2571fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095059, "uuid": "f3ce184b-94ba-45a4-bb67-3ea9ea07d9f6", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1cdc6e-b7ff-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762096941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096941, "uuid": "86440859-8cc7-4c84-bb18-03d7fdcb71dd", "comment": "Malware payload", "value": "40bb27fd88bba214819eea1b981b47ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096941, "uuid": "c623f979-755c-47ac-8edf-133efd32483e", "comment": "Malware payload", "value": "94d4a725dd8c84e0e7956bf8314d1126aa75df0e1e34c5641694fd0549948ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096941, "uuid": "37c3a753-832a-4867-8c5d-1420026e1a66", "comment": "Malware payload", "value": "c5c32463510782865dfe0f5ef53d644588d16e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096941, "uuid": "df6cca99-5a38-4158-bc0f-9f88e74157cc", "comment": "Malware payload", "value": "edbfd4f36f392187500dc580822884303261759dfa81e3d71f83b427c1ea30ff424f5f66b2b12542fdf44485c1c9e899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096941, "uuid": "e0ccf2fa-d72e-4c95-b925-6cf34819afdc", "value": "T10D16CF07E5A584E9D49EC07883579632AB327C8A0730B1EF27D97A242F76FA05F1D706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096941, "uuid": "dec001ee-af04-4698-b5b3-c1a00618d7b6", "value": "928a1348fd22ec362e08a76d0569eb2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096941, "uuid": "bff31f41-d837-4b4a-9ddb-0bd3bdf25b69", "value": "98304:zsxfLD/zs8n+s/WdKWvNkJ78nkRbbuJb4:wd/zsCqdJmwkRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096941, "uuid": "116b18ed-a633-45a7-9186-12c84952afa9", "value": 4352512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096941, "uuid": "ce2261dd-99d5-44fc-abbe-3c4eb24393f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096941, "uuid": "c3a53d16-ecfa-4cbc-814c-6a0259024673", "value": "updcloudres.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c66ac5-b7e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762084366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084366, "uuid": "35f3c42b-8aea-46d7-872a-891c1709fc77", "comment": "Malware payload (Mirai)", "value": "4c2ddbb2a068d23a01aab7c8584d0b90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084366, "uuid": "98f46d9e-2798-49d6-8fb4-3332e9db55b2", "comment": "Malware payload (Mirai)", "value": "95c384d4e632efc0f7a3e726e6a1072c77195ba5eba0be2e91e451c01a4e4579", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084366, "uuid": "02a2328e-aa55-4356-b70f-d1121bdf3ffd", "comment": "Malware payload (Mirai)", "value": "5195fadbac689304b5a75ad9919b6abfa17a7700", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084366, "uuid": "a8de0655-cf6b-4323-a794-171f085ec3b6", "comment": "Malware payload (Mirai)", "value": "da18873e0f717f8cee32d9d91234f00b0bb20bd52581d31818b60500c144788644cea91f1591c72622f1e991fd0cc82f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084366, "uuid": "2378edce-c654-4993-bbdc-49e9226f851c", "value": "T17FC30886B891AB25C6D156BBFE5F018E33135BA8E3DE3203DD185F6477CB94A0E3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084366, "uuid": "43b04075-9f6a-47db-a40d-2cad7b415873", "value": "3072:afU+HbtLMOzYzZoz94mHVm6LeIthwOI+bs9Kfn1Anza:CUktLMOzYzZG9F1m+pbRbs210a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762084366, "uuid": "75ac0fc7-11e8-4db5-9c57-2b7dc40ab13c", "value": 122048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762084366, "uuid": "ff2a9328-d97f-4571-8a37-419823789588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084366, "uuid": "624dcd27-bc84-4af7-86d3-ed3cd24de2e0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26017c90-b783-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762043435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043435, "uuid": "a2ed76cf-3b1d-4c36-af98-1ae6d3f0fe00", "comment": "Malware payload (Mirai)", "value": "f3d49896673b86e4a9e026c3145d7151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043435, "uuid": "3898a170-6197-46e7-bcb0-1448332ac5ce", "comment": "Malware payload (Mirai)", "value": "964f3deeaebb885fe241c201201c29d65d931dc515d1f4d6818e5d7fc1eeb3a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043435, "uuid": "c3dd19ac-31fa-4554-b72c-0b7ee8613da9", "comment": "Malware payload (Mirai)", "value": "13182729bf4ab9256e0c7ecd5c70b33e9b9f1b27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043435, "uuid": "873df433-25c0-4304-844a-e5a9b219b719", "comment": "Malware payload (Mirai)", "value": "89359c60efce242a83a167462214180c7f853c97aefb76caf1d7fbcca22e7df050919442dab418fe574cf745e7b74404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762043435, "uuid": "25e39b0c-ce20-4130-bb25-065ac8b105fe", "value": "T14FF2F1085E344C99CCD6FB7C62FF481E6A0562523B5BD6F0C8A0680A808AF519F5E7DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762043435, "uuid": "7a5eaa3d-ee4c-4a22-a10c-78a5922ecca1", "value": "768:RECxo32MU1TqN6a7VnsWSxiugft7F1VKWb70TBVDrIkvTBGw:RTorU1TUvlWxiugF7PYWbQNlrIeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762043435, "uuid": "08a1a69a-0b68-4c3f-b520-282a5b500338", "value": 37352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762043435, "uuid": "ea98e287-b89d-4015-ab28-3d1ea5a835f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762043435, "uuid": "2d6f1021-eb7a-499a-a07c-6a68bf680ef2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1d1ca5-b806-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762100010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100010, "uuid": "429358fc-3bc3-4e9c-ac76-4a46535ef3ac", "comment": "Malware payload (Mirai)", "value": "cd4d44705b9f3c65fef1374283adde31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100010, "uuid": "4358ff30-ccd9-4979-a45d-952725fefb18", "comment": "Malware payload (Mirai)", "value": "96a5347a946df2da5d7caa776cd51926dd0b7aaecf4d2794b8a005b4f439388e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100010, "uuid": "ba6a2a05-7038-4eae-95d3-10b3adcee7b9", "comment": "Malware payload (Mirai)", "value": "cd42418c030d0784b61ee69a967a5df52edce1f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100010, "uuid": "57c2fb9d-0dce-4ce3-ab86-139a866a33ad", "comment": "Malware payload (Mirai)", "value": "c4b42422d0ba194a975e88f9f4bb2a97edc398a53e12b9922ebda175818411d5602a5d03b87084b9af97910e47763ebf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100010, "uuid": "463ca232-8876-47a5-b396-4d5d3a85cf70", "value": "T1ED34431A2A22DF7FF66C873547B78960979822D636E1D645F26CC31C1E3024E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100010, "uuid": "a972bf30-b326-45ee-9d97-aa53a68f0d97", "value": "3072:O1jtaQb1xGZtfl1bLN2wNvSwjGR2Ho6npZqn3EKLdV8JXsxj:O1jtzxGZ9l1bLdVI6bqUKL7UXsxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100010, "uuid": "34082bb2-05e4-4a46-b4e2-6ce396fa72f2", "value": 232376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100010, "uuid": "8500bafa-7f45-4c32-8932-4b3794af51d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100010, "uuid": "f157ca47-1d11-4097-abe2-90e000c2f7e4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e44607e-b809-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762101136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101136, "uuid": "183dc25f-0c03-4432-af70-9f2b8667b7ec", "comment": "Malware payload (Mirai)", "value": "69542ff7c376981ded08024480aa941f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101136, "uuid": "124b91c1-a483-4298-b904-2de7ceb9d2d8", "comment": "Malware payload (Mirai)", "value": "98c9a6e13030cb734675b0f5a77c8741396407cc323af8d9015874512347b05b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101136, "uuid": "3d4f4de8-c34a-4c39-b107-68c86caf06d8", "comment": "Malware payload (Mirai)", "value": "1839f8901cede013da6c681075bb3b7bf15f9eb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101136, "uuid": "cae2c6c4-3e06-4aad-b0dd-de35c06fa8bd", "comment": "Malware payload (Mirai)", "value": "baf52a5671f962629991138f6ee4e2ced9fe6fcad99521c766b2f7b62c9944ffaa0ed083a7cc4ef7be4fc496f9b0df56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101136, "uuid": "9c327bb1-61d1-4ec1-aff2-6eb63b708f11", "value": "T18A34B50A6B519EF7D86FDD3705F5870125CCB04722A83B3B3674C62DB95AA0B49E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101136, "uuid": "2a65f96a-d613-42c5-80b0-1cab77997b52", "value": "3072:ERkvDsVwmOGQq1CHM71geKDA5s7VHA6g9K8:ERkLnBGQAQMhgefE89K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762101136, "uuid": "14684779-31ba-439b-b11a-e2f9e1371060", "value": 232412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762101136, "uuid": "e577d828-30d1-4413-9f42-155b90ec2344", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101136, "uuid": "3e4601fd-f9f9-4fa3-92b1-24de5a5386a3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e487b89e-b802-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762098301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098301, "uuid": "3319fb67-b741-4ce4-91bd-e01f1f628ca4", "comment": "Malware payload (Gafgyt)", "value": "846c33817fa61fe9a4a3ddd1d7a32f32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098301, "uuid": "01f382af-af35-4b55-b380-9e1b047d9e57", "comment": "Malware payload (Gafgyt)", "value": "9914fd97c22e39750a1103b341238ac8509f6fac719d225a0dd33334d182d8a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098301, "uuid": "37a4ecab-c4f3-4d98-aef7-b8e3a1b1676e", "comment": "Malware payload (Gafgyt)", "value": "6fc5b3e143a6c98a490f237769008f44d90d846f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098301, "uuid": "0bbd5552-e372-44d1-8cb9-0f2e613df7b0", "comment": "Malware payload (Gafgyt)", "value": "b9b40f827143cf37a3db8bb9fa5c3f6f00ca4d3fce07a6f33b2a4561a5711da473b90b30e68f1f524ac334aad904d2f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098301, "uuid": "0924a4d2-6bd9-422e-b78e-bfcb8918d3cc", "value": "T140D31A77B61C0793C4C706F11D6B3BF28F68A2F312E721C5661ADA908B739B61512F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098301, "uuid": "a9aa7131-9f62-455e-b35a-af08a2787830", "value": "3072:Z+2bDEXB9n4tyeA45hBffiE7ODmzj0qDJAGyoze:Z+2bIXnn4tXA45hBIDmzj0qDJAGyoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762098301, "uuid": "bf20cf99-7a83-49f9-b19f-7f5a436ff23e", "value": 141477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762098301, "uuid": "5cf27412-f63e-4cbb-90c7-dacfc285235d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098301, "uuid": "2abdb584-b167-4958-ba9c-0898d6a4430e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe51279-b7f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762091233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091233, "uuid": "0d1e027f-3fff-40cc-ab72-59fb4e04300d", "comment": "Malware payload (Rhadamanthys)", "value": "4c6c3acb318db12b2ad5ff085a367a24", "object_relation": "md5", "Tag": [ { "name": "217-156-67-140", "colour": "#E2F216", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091233, "uuid": "0acf19ec-df08-43df-82cf-565c4ed1e48a", "comment": "Malware payload (Rhadamanthys)", "value": "9915d0cb9587f1b4dc6a30e923a4a40c225ffa9b88a360c0bb3acfec216fd206", "object_relation": "sha256", "Tag": [ { "name": "217-156-67-140", "colour": "#E2F216", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091233, "uuid": "f9d0acea-91d3-4317-9167-8ba820d22d62", "comment": "Malware payload (Rhadamanthys)", "value": "c294590ede68d906bdf20e0d8715a904b1320e92", "object_relation": "sha1", "Tag": [ { "name": "217-156-67-140", "colour": "#E2F216", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091233, "uuid": "6014c52d-397c-4a9f-8d42-d9805ad97753", "comment": "Malware payload (Rhadamanthys)", "value": "3ecad67184e662ac373187a9a492175e2ccc659c65eac04d869b967ca7b317354b4a68924d62cb6e95165219401e79ce", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-67-140", "colour": "#E2F216", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091233, "uuid": "f849f907-5741-4ea0-a012-b6b1b9f8feeb", "value": "T12686BE10B7984075D9EB163418AF6726A37FFD505BA086CF2650A39E9C313C2AF317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091233, "uuid": "372dda6a-e15c-4b3d-85a0-c391bf1f1151", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091233, "uuid": "6bf3daf6-4eaa-45c5-be97-5dd75ae9bc5e", "value": "98304:Yi3J/ANEvLIxa4nXb1Ru0DNw2eziRdhhbuXzrHKc28R:oNKruJRJdhhKPpZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091233, "uuid": "c3566345-a857-4ba4-8520-9a5b30313281", "value": 8597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091233, "uuid": "fcbfee62-d6ca-4131-b6db-6fee2500903a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091233, "uuid": "91d5f779-6a9b-462a-99da-ee38548e8be2", "value": "appFile_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7e6b1e-b7b5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762064974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762064974, "uuid": "a91c2672-b8fe-446e-8871-4a0cada6d55a", "comment": "Malware payload (Mirai)", "value": "d5d6d5080673b7e9ac93d03f4a214c63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762064974, "uuid": "574ddb07-baf5-457c-a473-402b3901a3f6", "comment": "Malware payload (Mirai)", "value": "9a4e3685eccfe91d012e7c72097d39598029ed0e773ae4d6d3e9b1c6ff560dcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762064974, "uuid": "546b2b66-0686-4777-940a-6c8be3b74c9d", "comment": "Malware payload (Mirai)", "value": "d90b6c00770f049c2712a1549c1548c2857fc312", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762064974, "uuid": "5b1cd229-d20b-49ff-8c93-edcefeab2540", "comment": "Malware payload (Mirai)", "value": "b5e3ce99fd8e75b28f2a5160d5734443786daa211ed7820e4a37747f15d364e966e7c09f40d19b5bce46caeef8fd5dce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762064974, "uuid": "ee847532-3b51-405b-9e67-2cd6816821b7", "value": "T1A0435BC1D903D9FDE96606B01132F7378636F53D102DFAA7D768AA32BC92A40D61639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762064974, "uuid": "b4b020f4-7ef3-41aa-ba4f-57fb456b6b9b", "value": "1536:nfwYGub6vq6VBRqXr62rsN77NAyM0ztJgrv4IvEW+W7XszB0VznBuGPH3xcXghtt:nYYGS6vq6VBRqXr62rsN77NAyM0ztJgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762064974, "uuid": "e5a2a838-df3a-47a0-b280-dbf69beae758", "value": 60372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762064974, "uuid": "50d24f3a-bbdd-474c-b8c0-48c2dc980fe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762064974, "uuid": "774643fd-1183-4ea4-9033-2f4f3b3feca5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014aed7b-b7cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074297, "uuid": "5f784042-4084-4b9f-8643-17f8a193031a", "comment": "Malware payload (Mirai)", "value": "476760f22525b5ca775c665971b0eb1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074297, "uuid": "746d8d6f-6d9f-4c84-aba4-c69f26ade8a7", "comment": "Malware payload (Mirai)", "value": "9aec1ca314c80d2b65c6bc45dadb07161741f947fa53f20dff5736d740c49b10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074297, "uuid": "4dea7f1c-cfdc-4e69-b57f-49adcb7f0322", "comment": "Malware payload (Mirai)", "value": "488eddd7988ff47ae64df9b16edbd3d2646b8f02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074297, "uuid": "943aff97-6eb2-47c4-8efb-6fd628dd8d9e", "comment": "Malware payload (Mirai)", "value": "6d526bd7e42da5ba10cdb95834f0ea1cc5e79a9f9fa7247e8003cdff16ceffbac7f7db2984d993b3dae41e308cf0413b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074297, "uuid": "39c6e732-7857-4545-9e7e-b3b9767b8206", "value": "T12E044C56EB418B13C0D6277ABADF4245332397A4D3DB730699286FF43F8665E0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074297, "uuid": "bb62d31d-8c51-4add-b641-91c3bc48f6e0", "value": "3072:u53Ok2ZsJmVa2EOQi+TwhJnzbsNyROQ2LG6UXM/9QRIUwvRZ+6:03Ok2KEVa2EOQi+khpbayAQ2LGhM/9ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074297, "uuid": "32229783-b295-47b0-b8a5-91a99221efce", "value": 173754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074297, "uuid": "af97d19c-9af9-416a-bd3e-dbd2c3def280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074297, "uuid": "a7d368b7-a0d5-4043-b553-979c5afffa87", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65854f2-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074252, "uuid": "26f1357d-9aff-45d7-8d21-258a2a4a905b", "comment": "Malware payload (Mirai)", "value": "e5a38cd5846877e648bbc7bb5c65668e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074252, "uuid": "dbcc78bf-8894-43d8-abf5-5556b17bb598", "comment": "Malware payload (Mirai)", "value": "9b1fec57c75d8ef3932162327a6d53ee3d327b052a34d0464d1e471eaa004e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074252, "uuid": "7dff33cc-e112-42bb-8b2f-95f33bc1e48b", "comment": "Malware payload (Mirai)", "value": "8a0013349566bbc36b15bfc212ec8318e50c34f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074252, "uuid": "b03198e0-fe20-45f1-ac5e-ace24e0a09e7", "comment": "Malware payload (Mirai)", "value": "d2b9ea8ff7c3f5a02a02f16ced283b021a61092727e12f4b9d54707cd6b7b068db510b9d37ca204cb3836333a1f887b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074252, "uuid": "88f97a74-0569-49d8-ac83-ab82f1fe2925", "value": "T10603E17DE4E43D6AE2AF0CE21C29DB416BEA7ECD2BF5825131405F919D1709E0B028F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074252, "uuid": "ff3b7a82-1df4-4642-bd1f-cf277368a26f", "value": "768:JBoFuhyMYu21sszz/Rhz8syme/det/84Ck0tlcceFbTqd08qDThKXItvJ4uVcqgF:hhz9MsszzphgshIdeF1CkklcTqwDxtvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074252, "uuid": "da2b1ebc-a754-4c50-9481-5fbf8cc0f54f", "value": 40300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074252, "uuid": "34751a73-ee63-41e2-aae5-b7aee2547543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074252, "uuid": "189ed7bb-3b45-4d6a-8d88-62b648aac379", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a114ae8-b7f3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762091733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091733, "uuid": "3e7eb3f7-994c-4433-b9fa-2688a3eac30d", "comment": "Malware payload (Rhadamanthys)", "value": "66b91fe7132fd849e471de9233e711d9", "object_relation": "md5", "Tag": [ { "name": "194-102-104-244", "colour": "#1ACD6D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091733, "uuid": "dc4fb1d0-b613-49aa-a34e-f585c1171f14", "comment": "Malware payload (Rhadamanthys)", "value": "9b5d41f3a087cbf9df84d166331f62c7da0ec4185c4323cd69b124fc087f38d9", "object_relation": "sha256", "Tag": [ { "name": "194-102-104-244", "colour": "#1ACD6D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091733, "uuid": "f46e2844-d236-4c77-a955-b40091ba9ce0", "comment": "Malware payload (Rhadamanthys)", "value": "efb03b12e7b0903d03a47474e8b09ae12fc10b96", "object_relation": "sha1", "Tag": [ { "name": "194-102-104-244", "colour": "#1ACD6D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091733, "uuid": "de12d671-5de8-46cb-b14a-ec48175bff35", "comment": "Malware payload (Rhadamanthys)", "value": "51d4b4f0b94a70c41258a3541b6ba427072a246f62fcd7575f69a0a616f3351afe94499d16bbcbde5b9c1725223ccd0d", "object_relation": "sha3-384", "Tag": [ { "name": "194-102-104-244", "colour": "#1ACD6D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091733, "uuid": "dc951239-75ae-40ca-834e-39ccfd865990", "value": "T1A8E63302896F0981DDD3707BB1EAA5F2227A8475D6F64C178C4CA27454EB3E2AF77813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091733, "uuid": "fac19fed-53d8-446d-905f-b19b392d2ac4", "value": "393216:3KvMJDxulD2ONtRjVpmIC5s2D8S1ysfAoL+mXXJofH:3tjkDNDjDmTJD8S1ysfAxOo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091733, "uuid": "affff006-85ab-408f-ac6f-cf2b63c2bcc3", "value": 14656350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091733, "uuid": "a1ecfa85-cd1e-4c03-89cb-d04a7f7d4fde", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091733, "uuid": "004f9918-12e2-4247-9892-273e6e1c3ca8", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969fe3c4-b833-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762119215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119215, "uuid": "f885f4d4-e216-4a1b-908d-3e26a38cec80", "comment": "Malware payload", "value": "e56a2e3e86e9bd7f7925b39c2204a05b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119215, "uuid": "3302f544-644b-4618-84a2-c9393e596da6", "comment": "Malware payload", "value": "9c0c1834b68c2c3785d02177315f33d67a1ecc75b4c87cd0321a5e5cfc67301d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119215, "uuid": "ca8a679f-6910-4baf-983f-99b6d0f9f2bd", "comment": "Malware payload", "value": "8081a31692a99e77f6052d42fc85547892c9f258", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119215, "uuid": "6acf4e90-a436-4ee8-8935-b9def3d77a01", "comment": "Malware payload", "value": "53a523daa052e9c6484b9a94d1d11026a3b5c75f0077e34836c14ef8d4563ccb45c8a3fc3315ccd62c9fe10c290f1066", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119215, "uuid": "1542833b-5ade-44ef-8944-830420cebb57", "value": "T12CF56F7A916EFB14C11D27B97239BF952869AD038FB181DB3F7424653634CA22D20E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119215, "uuid": "b4513c14-84e5-4567-a646-f24c4c1b01a0", "value": "49152:Hrsc/f9r84jEHYDgM5+7vZP/1Ujgk5I/U0Hsm8OuQMhMgeCaGRljj5Gxxp:gVHYDgBFP/ijOLGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762119215, "uuid": "b4324d39-ef88-464f-9cfb-b1db402029e3", "value": 3329024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762119215, "uuid": "8645c6df-bb52-4138-a054-ad37c2be7547", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119215, "uuid": "5f183776-7332-429a-87bf-c7b12631d9a5", "value": "NotaFiscal.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f54ed8e-b822-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762111794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762111794, "uuid": "a545ee38-9be3-4eaf-87f3-ceebe098ee10", "comment": "Malware payload (RemcosRAT)", "value": "be40090d94d51ca6e3ca039e1ad5984b", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762111794, "uuid": "3d588a55-5cec-441a-a028-7fd56d88bdb1", "comment": "Malware payload (RemcosRAT)", "value": "9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762111794, "uuid": "88c67a7a-fffc-4449-b6bb-ffc478e185d6", "comment": "Malware payload (RemcosRAT)", "value": "3c66c86bab793d4e26b75e5a7f6c97f6d1d52b4c", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762111794, "uuid": "966d0296-cf79-4583-9204-31b8bda75912", "comment": "Malware payload (RemcosRAT)", "value": "d95a863585d748bdfd1cc6ad57a35fea2df497acd984fcb537025158034861e0de5b6e2d2beab4cb6109986753876308", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762111794, "uuid": "cbddacff-2221-406e-8039-475bdedb45e0", "value": "T1CD7302E6A10B2650C2AF97B56EECD16488950E60824F1410D30D935C3FBFB936BB7385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762111794, "uuid": "bfd59f64-3ae6-4301-a97d-44f3e146f446", "value": "1536:ZutYvdh38n/DDIrX+OPcVnnM1CUJsxJY3NFgH84NA+2syuQee:UtYvf8nIixM1CHUzg8QA+2ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762111794, "uuid": "a7616fae-f5d9-47fc-a218-8f7ba7f01ccc", "value": 76945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762111794, "uuid": "ae0d31e4-1fdb-4254-ab55-cc559b3de4de", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762111794, "uuid": "3c186e6b-8a2d-4ad7-b5cd-0a89f8a02785", "value": "United Alliance-QDB80300028.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c91b3c1-b812-11f0-91c6-42010a9c0006", "comment": "Malware payload (HijackLoader)", "timestamp": 1762105025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762105025, "uuid": "d3746c71-5e25-45e8-af04-54ea153e2088", "comment": "Malware payload (HijackLoader)", "value": "ae78acb8120592579e12fb2ec7604ea9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762105025, "uuid": "b60ec416-7dda-4c76-9736-49c7f02c994d", "comment": "Malware payload (HijackLoader)", "value": "9dad77fb8613c5e3a4d77884eb87a6273eba48bc51d5b28f81e3c06c6507a3e0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762105025, "uuid": "8b643d2b-6d3f-475b-82e1-3fe3bfa7b073", "comment": "Malware payload (HijackLoader)", "value": "2c46e74921b48f736e010a65304b777bcddf7f7a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762105025, "uuid": "3b2cc739-acf2-4bd3-95ed-947489364507", "comment": "Malware payload (HijackLoader)", "value": "e2492b9f423563cd385b7105bfe1ce7f2c0dd01fa62f1c32c3613d253bfbdad9e61068403c805acede5c4576c49d8f8b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762105025, "uuid": "6c0b966d-18f3-4fd3-830a-d183cad55f79", "value": "T1140633003744A8B6E16ACA338F98D7651573D7E523427E4B29C92E6B9EE3032D3871DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762105025, "uuid": "d8abe29f-a39a-4ac6-9539-a758687ab348", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762105025, "uuid": "91e12cce-b878-472e-9475-1bb602b6d98b", "value": "98304:+pICnuAiATB3RvSjg7+uR95uQigaUCPE8Y8XSZoKqn0:+pLZT/qkCuR95xiACPEUSPqn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762105025, "uuid": "78d4113b-f4db-4277-8fb7-fd5097ed81a2", "value": 3677900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762105025, "uuid": "55712fbc-200c-47da-8a57-00d5318d3caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762105025, "uuid": "cf43dc46-46ec-4492-9e5c-25f5f3dc1d45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca2ac0b-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103790, "uuid": "eb134d18-db79-47f1-b20b-81f7b8271e2b", "comment": "Malware payload (Mirai)", "value": "da723264ff6f7ed915c6f07e19e5bf43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103790, "uuid": "cf7de29b-e690-41b6-a7c6-96366d7d2e8e", "comment": "Malware payload (Mirai)", "value": "9e52348fd16e62d2c75a00d1ce6989ad3095857bf7abfd9819e64aa391fa36ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103790, "uuid": "442e27b3-ff7a-48ed-82a7-ac2bf766fd1c", "comment": "Malware payload (Mirai)", "value": "689c07a05f929c68a3a349fa8b85bcc3db4f619b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103790, "uuid": "27a03813-1514-472a-a4cf-7ff0af3a90aa", "comment": "Malware payload (Mirai)", "value": "a20fce9ea6e1eccc9dd82f9f9fb019e02ae8bb0b5717e997778c1fe39f3efe1e0bb05258cf3c568c7385b8a1d649db34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103790, "uuid": "cb7945f3-0cc2-44b1-9e74-7f076b1de604", "value": "T1B3336B36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103790, "uuid": "a74beb92-0277-4ac7-a195-e1de6559d19a", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBzm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103790, "uuid": "33ce9885-1454-45b7-89d8-731fd68572e9", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103790, "uuid": "38b08957-f630-44e9-b230-1c4fa76455c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103790, "uuid": "cf644ec2-3f50-4caa-928b-b4fcb9aa8c34", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711e90f9-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762095960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095960, "uuid": "216e9cb3-a3aa-49f1-9f8a-b7d62d632160", "comment": "Malware payload (AgentTesla)", "value": "8da6b9381877c9df2e40305af4fd8113", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095960, "uuid": "9cb1c92d-7751-4d56-99b0-7bbf9cfa6215", "comment": "Malware payload (AgentTesla)", "value": "9f51a80789af2c8e0933ffb19de8f6e43b1c6f766e55e2441703e6ab4b7bc4c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095960, "uuid": "751cb1e9-ee5c-4e6e-8df1-feef6aef1aba", "comment": "Malware payload (AgentTesla)", "value": "1017308d3ca6eca9efe0b896b1685c41b5dd7ee7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095960, "uuid": "56fe1927-5d28-48a2-b575-1c3ac1cd0780", "comment": "Malware payload (AgentTesla)", "value": "eebcbed95b57c0407702888b46eca539afde480446839b3ba4de6b84a875b7bca2b52bf7c6ec629f5367bb449ed5e472", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095960, "uuid": "fd64aabb-ec41-4d70-b2f7-e5545f4f1d4f", "value": "T19075AC489AE46F13D63E83B5C9E789A473B69898FF4BD3579A40706205027E09B431FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095960, "uuid": "63ccaa23-062e-45af-a819-c28506674e9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095960, "uuid": "0bf27a9d-0551-41da-ab50-a53ad62c9746", "value": "24576:u8TBhqI0eePruqKgIxVgUUssTcdiVPor9tjiPai5HDKckHTnI91pFcoe8sg0nPqB:uD3e9sgk4jil47s1XcoHsg0Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095960, "uuid": "ecf9a5fe-3ea2-4fcb-98a2-67837f9fc378", "value": 1695232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095960, "uuid": "74f10361-0c05-4c49-8dd8-755b28400284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095960, "uuid": "d5ace1fb-9542-40ce-830b-781704fa412b", "value": "NK25091092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e195b4-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762095860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095860, "uuid": "51f5e078-91c4-49bd-a449-908ff578f76c", "comment": "Malware payload", "value": "9a7c87e33da0a6f6f446c46e61ba45c7", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "shiguanji-cn", "colour": "#A593DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095860, "uuid": "186efb15-1ab9-4d31-babf-569a6aa9564b", "comment": "Malware payload", "value": "9fcf353e3c5e2515f5b535ab19a1a80b51e6a21033c30b820db3d9837c185b64", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "shiguanji-cn", "colour": "#A593DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095860, "uuid": "10f9cf23-0d7c-4724-b7dc-7c5b9b89ac05", "comment": "Malware payload", "value": "4abe3f81c22c14c33ac075b2bbb81f070c9867f1", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "shiguanji-cn", "colour": "#A593DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095860, "uuid": "0ac1a42b-ce4a-436b-80db-1cd3ce04d92b", "comment": "Malware payload", "value": "60d97a66da4144d1d7ed01eb7dfb9cfe9724357dc8edca5297915f5f7f5839cf5e38cdc1036a962ed2a8d3b690bb393d", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "shiguanji-cn", "colour": "#A593DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095860, "uuid": "f21c5c93-753b-4ff6-a9b6-d1766c4b61bd", "value": "T113473321A79BC426E14D067BD93EEF1E14797E77073000E773E4B98EA8B04C1967DA92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095860, "uuid": "7f51dea5-e034-42cd-acba-c89bfb0d8e2d", "value": "786432:LC+X/XudUEQU+5Njh2ZlVnenl5yi6dYrL:L9PXmpk5PSlMlYi6dY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095860, "uuid": "515d2da2-e07b-473c-a1ba-687a16472815", "value": 25644032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095860, "uuid": "0acb4ecf-3ee8-435f-9d12-da8bd0dcce45", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095860, "uuid": "078b8150-1f3c-4781-8bf3-01a71213b9d8", "value": "letsvpn.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50c50da-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074250, "uuid": "31dccebb-995a-4544-bd00-32a11e0e17de", "comment": "Malware payload (Mirai)", "value": "875c0d641165fe7758002862e8ef442e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074250, "uuid": "5021f12f-3cda-488d-a912-db9422e96c23", "comment": "Malware payload (Mirai)", "value": "a0119e82c52fd1cba0f7d67a8ce242301f54186803cef3277ec0c4ecbb5a2151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074250, "uuid": "a6d8f2df-2d67-4311-bc5e-c60be4655791", "comment": "Malware payload (Mirai)", "value": "9e4df6739817d3610c68ff17741187e2571c2b20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074250, "uuid": "d36b43fd-f466-4a0f-bf3e-f79d87bffc8c", "comment": "Malware payload (Mirai)", "value": "f5f4d76bb0df141e8e9519925e16438f202de79d2e5ef66a12fc43b69f973e897ab94cd08c40e7de312b9d6407205ed8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074250, "uuid": "e72b92a5-0bc4-4667-a0bf-db1241fb05bd", "value": "T144B2D02546D7ACB1C3341836D95D07A267C992E8C2ED7032170193BC7F8AB6556F91CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074250, "uuid": "866a68b1-0284-4a8a-a931-a292f9d05549", "value": "384:oUTkXpSh08un8tURgonjwjzdJ0GD9y0ryzaT6QSwFUChBUtxQksPJaOQDIWHAoUg:mZQDUVkjzdW0yuT6HwS2BUt2bxMcLyPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074250, "uuid": "c8f5186b-c694-4699-9968-552e6c3e3dcc", "value": 24240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074250, "uuid": "38e10ae0-b249-4556-bbfb-ad0b3096ddf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074250, "uuid": "1a7946d3-ade5-4e27-a35c-f2cad3d3a762", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97545014-b80d-11f0-91c6-42010a9c0006", "comment": "Malware payload (EagleRAT)", "timestamp": 1762102896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762102896, "uuid": "f3675e87-a3f5-4656-8084-ad863c232ce2", "comment": "Malware payload (EagleRAT)", "value": "241897c4d6cacc347de98f3212ba72e1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EagleRAT", "colour": "#48199D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762102896, "uuid": "fbade1e9-9a27-4860-84d4-8c05c8ca8f35", "comment": "Malware payload (EagleRAT)", "value": "a28e27653070e97c1bff76407eecc9f40832f265ea4373babb30669854927b3a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EagleRAT", "colour": "#48199D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762102896, "uuid": "8a989afd-91e0-48ff-9cc9-0e3c8d965230", "comment": "Malware payload (EagleRAT)", "value": "2c6eb5d19cf9197d9888ed591e198e146dd9d2e8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EagleRAT", "colour": "#48199D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762102896, "uuid": "5ea9b4ae-e7b8-4c15-854c-7a69110a111b", "comment": "Malware payload (EagleRAT)", "value": "c93af0d5907e93bcdd57d86e435248230fe0b3008b89b4b15121aee520bc5b568b8978e6bda46afde53a4fe8c6460a0a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EagleRAT", "colour": "#48199D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762102896, "uuid": "de2f9fd6-9d74-431e-853c-958fa9c3a667", "value": "T17F41333EF0C21B1182501E60A076EC9253D5E5CBCFB90857F5E592D70E75349DFA4AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762102896, "uuid": "f0e16042-ef44-42be-9fdb-8fb0bb7934b8", "value": "48:F4DY777x/LSa/Steiu5gXdm4jMlLV1IgvL+dXUt2tptx:F4DMSteiu5gXgTF3j+Nigjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762102896, "uuid": "582d8167-5dbf-4225-abec-3eb65cc0d4d8", "value": 2395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762102896, "uuid": "69985ef2-53e2-4ec3-9602-e86fa63d70fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762102896, "uuid": "0de3b978-3561-4ba0-9dc3-af43f6b50d93", "value": "3949.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3fb641-b7d2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762077376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762077376, "uuid": "d16c4b70-cccc-43bd-8d78-5de9d16c80c0", "comment": "Malware payload", "value": "31f591eb87f6f21dba1803163c1991ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www", "colour": "#64FFD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762077376, "uuid": "a9005bd5-78c4-462b-b661-b6d49b9f8301", "comment": "Malware payload", "value": "a519366d14efa5fec194f417c9cc1982aedc0be66496b51244231efa2e4d397e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www", "colour": "#64FFD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762077376, "uuid": "4256f7fc-0c88-4c1f-8712-67b307a3776e", "comment": "Malware payload", "value": "fc3a26d6276505d8c800d2eac8565f5d6bc4e825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www", "colour": "#64FFD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762077376, "uuid": "83a1de17-d09e-430b-a75f-48aa79b422e0", "comment": "Malware payload", "value": "d31e3bdede724c4ba18e20a641146589ad94463e8a2d94da5fe5acde5abc6e2ce2ccb2e6e9163cd0a2e2886ffd6b90cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www", "colour": "#64FFD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762077376, "uuid": "44308a4c-f43c-49a7-a19a-2f3419895538", "value": "T1C47733DD38614483C89E27FBEF5EA44E97805A3151EDBB9B74463EE3BA4C80F6105E42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762077376, "uuid": "f1a78541-c3b7-4701-a43b-69cc7c82e34b", "value": "35643633640e1a7cf4687159af49667a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762077376, "uuid": "7e3e6c46-0d5f-4cb0-aa11-680f1fbc8efb", "value": "786432:3De1F31sfiPV/wUR6p0tXqKkr591iJhwjtSNf0SoO:sF3GfWCk6p0kbr59MhCtIf0SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762077376, "uuid": "3f1e2a4f-280b-459e-b7ac-3eb27df69b89", "value": 33651728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762077376, "uuid": "b343d552-4be7-4b68-bc8e-7e95adc4915e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762077376, "uuid": "5999c13e-60d6-428c-a2ab-9395fd1d4dda", "value": "wpoof.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edbe421-b783-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762043530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043530, "uuid": "119ed5da-3fbb-477d-8cc9-7cee7d73ac89", "comment": "Malware payload (Mirai)", "value": "906121db4d377a00fa54e801ac7a5bc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043530, "uuid": "b8e4f67c-f77d-49be-8838-40c3b865a6e7", "comment": "Malware payload (Mirai)", "value": "a5e66c186e2ba44ae4dff2cce6e1f68b0e8ebe52dd3580794762edb4dace9660", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043530, "uuid": "9837c83e-6289-460b-807e-21eb0e023952", "comment": "Malware payload (Mirai)", "value": "7c76550fcc85652558ea0f0ad990a809a86966b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762043530, "uuid": "83e5c17a-b1f5-413e-9aab-240c46cdd067", "comment": "Malware payload (Mirai)", "value": "d7ede18bc690175f5fa8bdd2bbbebdba6f31cd521572ecc5908a1af514b2f9a3652b7f62308af68df4681c2704909192", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762043530, "uuid": "f76c5809-fdf1-4ab8-a206-3c69cc88f595", "value": "T12E93D806BF600EFBDC6FCD3749E91716248D650A12A97F3A7934D92CB60B24F19D38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762043530, "uuid": "6a2d2525-7202-42c2-a2cc-b707a750b3d5", "value": "1536:+QkydZCuYXCr9tDhwMp77jMNFB1l6OtYLLHcVhSt6c:+WdZnYXKp77jAFBi98YMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762043530, "uuid": "f404d230-2a60-4da7-a1cd-982edbb5b267", "value": 89900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762043530, "uuid": "6c6d7ac9-36c2-4aee-80ea-025549a36347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762043530, "uuid": "d704dd6c-6717-4ef5-ad48-832573d60981", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4678b7d-b7e1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762084127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084127, "uuid": "698c6626-4469-4c65-85d7-a5d48153c3c8", "comment": "Malware payload (Mirai)", "value": "7cc0cbee3d6e921161cd93e5624ec086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084127, "uuid": "9fd3a68c-7b86-4132-b7b4-4aa2ec028346", "comment": "Malware payload (Mirai)", "value": "a7689a1829428b911ba53efa8758df720d5cfa4ced828cd244eb82e869d36ec2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084127, "uuid": "46346bc3-f9fd-4ed2-9a65-5463852a7976", "comment": "Malware payload (Mirai)", "value": "51e8b3f7c8d23be44974c6dd564826dbf7a3b949", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084127, "uuid": "f0a0477d-3e14-41c4-b6cf-3ad1c48f3991", "comment": "Malware payload (Mirai)", "value": "458167299614c8d5f752dbb87b2cfe38e1475a8c15ba35ecc92c3564de8a60178b68fe5cf967ebe806d342556f005a11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084127, "uuid": "355d2d0d-0602-4395-856a-f864e0ce0dbf", "value": "T1BE03E14F3E29DF52E3E2D2715F566487B4788A00FDF02AF271960A275FCFAA215165C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084127, "uuid": "69cb7bcd-2106-4776-84bb-d062871cc3e6", "value": "768:C8a4BLjc/phNK8XsDSyg2+mhNpRbqe1HIaAPRY1uDS82RgDhG+2v6Oz4lYwox07J:C81vc/JK88DNHthvRbBzAPGm6RgE+ekR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762084127, "uuid": "1c91d7bc-3e13-4c32-98ed-79d6091242f3", "value": 39660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762084127, "uuid": "930f5882-199f-40fb-91f8-95bceb5c8692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084127, "uuid": "7d755e0c-83d9-4508-a9f5-309f8806f352", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cb6b76-b808-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762100618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100618, "uuid": "d03cdeea-23cd-4be8-b48a-0005710ca58f", "comment": "Malware payload (Mirai)", "value": "d1964bb471f19f6858e6e54c92b69099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100618, "uuid": "a77b8adb-e35d-4616-8794-da95b012ff34", "comment": "Malware payload (Mirai)", "value": "a79cc90a931952367f7eafbee1ac05275c262cd669a66b1359cb3a307c64ea80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100618, "uuid": "294b2cc7-9128-4920-af85-bc0d94a91b6d", "comment": "Malware payload (Mirai)", "value": "52d97790582288c7fdab2ed6c306835fca8699d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100618, "uuid": "7b50553b-cd02-4d85-bab0-be91c3c0ab26", "comment": "Malware payload (Mirai)", "value": "4d9275d2c422a3900bb8d619907e37e771a427be0258b03db0030acc87e8a6429cc67c2598a2df89dab7043a8620b47e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100618, "uuid": "239ab95f-00bf-4875-8876-cb83b72420bd", "value": "T1FE93C65A6E118FADFBA8973047B39E21635C33D636E1C685E29CD6001E7034D646FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100618, "uuid": "2f5e0c93-df12-4905-a0e4-32ff4f786971", "value": "1536:4IckMH/MHQWUNXabP+mXZM/NQxyBzcQ7le9OVahTOE:4IVw/wQ3KbP+mhyBzp77U/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100618, "uuid": "0126e9bf-a8ec-417f-b20d-9ad2fe0f6bcb", "value": 89148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100618, "uuid": "ca41296f-5985-435e-9b0d-0fc642f97020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100618, "uuid": "35373bc9-0771-46d7-91a5-f560a2b5960f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9651a8fc-b7dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762081849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081849, "uuid": "e6b8df93-b9de-424a-99ea-938361d4e907", "comment": "Malware payload (Gafgyt)", "value": "614b513bfa2efa83715b90aa6d8c74bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081849, "uuid": "209a23f9-2492-4732-a561-b70366975fcb", "comment": "Malware payload (Gafgyt)", "value": "a8c760bb388ab5567e3fd98006fe4bc7d66e0832139af3c526de0c87709779de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081849, "uuid": "12630653-fd24-4648-b8ff-e3d23bab14b5", "comment": "Malware payload (Gafgyt)", "value": "c09eb942a0262ea740cc0f06ffd072b5d6b6d4b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081849, "uuid": "76ab508d-1c68-483d-9c11-aa0ca2fe6446", "comment": "Malware payload (Gafgyt)", "value": "0e9d58876fff8d72b0cc1a422cf816f709dbdc5f8826b430b529046a9c47fb676344a48f3e5814f41685aff504e9b766", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081849, "uuid": "c3ebf84c-1120-4158-ba1d-d1c8dc7dd862", "value": "T105E31910F841476BC2D323F6A64D879D3F3517E623DB33115A38AEB01FC2B992D69964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081849, "uuid": "200b519e-7f13-4138-ae56-db4b0cbec99b", "value": "3072:TuK+kVuMeIu4RW8X05h80e/lXmzZQQAhtRq6AAe:Fu49X05h80e9XmzZQQAhtRq6AAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762081849, "uuid": "36398473-c65b-4f39-95b9-ff36dcfa6243", "value": 156077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762081849, "uuid": "12f845e7-c5c0-4d1f-bc15-5bd92fcfe491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081849, "uuid": "9130bd6b-c108-4ff5-b641-52f5619a3d6d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4176ea-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074290, "uuid": "40bac0d0-2379-407f-a997-7ecede672d19", "comment": "Malware payload (Mirai)", "value": "fad39f000f8453472446fb780f221273", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074290, "uuid": "69ac1ebf-26d5-4d64-8ca3-92d581e82780", "comment": "Malware payload (Mirai)", "value": "a93d4dc370be964289e9bd94477d5826f0e830179218731857ee22d4f9a5f30b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074290, "uuid": "99f5b8b8-b60f-420b-a244-03429ea50efb", "comment": "Malware payload (Mirai)", "value": "c2a1679ac6bd1c6f7eb495a6a5b978ad23e61a87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074290, "uuid": "d0f8aae8-f091-45e8-81cb-0d829312d7e5", "comment": "Malware payload (Mirai)", "value": "a9988a503a23a15696ac6104d44b1eef186006a60915ce862ed25940232bb930dcc0a7962297c9c0a21953b682dd5e84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074290, "uuid": "af0a2b27-ec08-4cd5-872f-0ccb8a545b00", "value": "T19DB3C61E6E218FBDF769823047F78E21975933D627E1D645E2ACD6011E6034E281FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074290, "uuid": "7fcd0649-290c-47b3-95bb-357419e9d80d", "value": "1536:N1jLy/jmsE/mq3i2nUydo2yHP/QGHVevMLrn61aHm:Dy/6sJ2nfo2yv/QM3614m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074290, "uuid": "dbc6121c-7f97-42c0-9d78-8eae8842350e", "value": 114044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074290, "uuid": "5db06152-1fc0-43b7-b668-1f7ceaf002ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074290, "uuid": "943ea9b4-66ba-40cf-bce7-2c2e6016c2c0", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b1583b-b7fa-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762094833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094833, "uuid": "035a0a57-e3fc-43b2-8dae-ee581682bd5f", "comment": "Malware payload (Rhadamanthys)", "value": "406e3459d3a5c8c874f461f2028376df", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094833, "uuid": "f010f679-55b5-4086-a1e0-43733e044f42", "comment": "Malware payload (Rhadamanthys)", "value": "a9c38f78c647ebf209a45e98dfc984d103663db89109ce79b981de810ab7e3ad", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094833, "uuid": "e68d1626-659d-4654-bc33-d63ab2fbab17", "comment": "Malware payload (Rhadamanthys)", "value": "d2dd55124328165b534d98e1845b12743d44690b", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762094833, "uuid": "bba4d27a-122b-4196-9c65-a391b52e773b", "comment": "Malware payload (Rhadamanthys)", "value": "7d758277284b34bcf23e3d98095245479e200487d3b0d38487a1234973b95b6483b40a9b62b56c7707fb6a08d75a9654", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094833, "uuid": "d583cd36-bc43-4621-bd87-b495cab3654b", "value": "T1EA75231B62E5B0E3E1790376D9F29092537239741F3847FF56C9E2B84EA36866133B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094833, "uuid": "eb0159c6-2063-4376-ae75-eb61c7879036", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094833, "uuid": "7b255dd6-f65d-415a-b004-9f601d042d96", "value": "49152:qj0twi3W6N/Ap3/MteQZa2dRUqI8+aQMqf:Yi3J/ANEvLIxa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762094833, "uuid": "8f921987-963a-46ba-9f63-bf15474901e8", "value": 1675264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762094833, "uuid": "ffedfd0a-80ba-457a-a80a-513a9aa988b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762094833, "uuid": "a5d0425b-4102-4c10-be46-770ec1b2c57f", "value": "appFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a465e71-b80b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762101988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101988, "uuid": "20753a1c-dd77-4e90-927a-853dee012138", "comment": "Malware payload (Mirai)", "value": "ea0bb09afe729cff88c3df36f2eb8bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101988, "uuid": "2d4a01b1-bcab-4486-a157-6187a02dead6", "comment": "Malware payload (Mirai)", "value": "aa740addda92c1ec10f53518cfea826cd5d67dbc4fd93f62a1f9eb5ca8d7cd39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101988, "uuid": "f690f10d-df64-468a-a6d2-ffe1764692b7", "comment": "Malware payload (Mirai)", "value": "fc314b5710059e9cc0af3aed158ed58a67c4719c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101988, "uuid": "53c2d251-ddbe-4487-b3b4-39c5d8edc64e", "comment": "Malware payload (Mirai)", "value": "31986b4939e204ec9874c844b96e8e00ce8941713741b62d947e73aac4a0f8663776972c30d0aacf48184a1d21511b02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101988, "uuid": "d2dd2baf-3fb0-40ab-88f9-c6567f948381", "value": "T183145C13B9655FA7C4829FB462A78B700B13E8650B534FBBB62AE9F409439CCF904774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101988, "uuid": "7a69cb57-2cac-491b-a42c-ade4e52867ba", "value": "3072:oK2uLG1N7QGdb+ia/BFC4W6eukMgV7H6A0QUq0n+9Pts2uq/7rxvqon:oK2uy5db+isqh63kMgV7Hmq0n+9Pts2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762101988, "uuid": "90e09510-2e20-42e5-af83-6f32a79a8bc8", "value": 192530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762101988, "uuid": "c12aa2cd-fc56-4be6-aa04-662bce2a9959", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101988, "uuid": "4fc54aa4-87f9-4837-abee-42222b045b60", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be5bc93-b805-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762099414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762099414, "uuid": "5627b120-61b3-4d71-97a4-70d1eece9522", "comment": "Malware payload (Mirai)", "value": "0cac038a77913466a9a7d7ba89fdedda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762099414, "uuid": "84793470-89d3-4299-aa46-61180ef322f8", "comment": "Malware payload (Mirai)", "value": "aa9f0b341fc7afdecc4f9c1ced2aaa352a47dc86ff19d49e57758577b86f3bee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762099414, "uuid": "73c299ab-130d-4aec-8c3c-cf35b1330f8b", "comment": "Malware payload (Mirai)", "value": "4a5f0d7842e44d9d0d71f4742b3553995e3bf095", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762099414, "uuid": "cea7c6ba-960f-4ff9-89e5-2c77d5455e75", "comment": "Malware payload (Mirai)", "value": "ea18fca5b5c1551db49a9f8c3145b4bb8fa85fdd450aacdb772f0bf55bf82c0f018e9de1f6c63250757895c0decb7f92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762099414, "uuid": "bfe4832c-4e7d-46f1-acbc-7d21182950fa", "value": "T182240A01B8414F53C1C61BBAB6DF41893B3277A493DB3306EE24BFB42F4669E1D2A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762099414, "uuid": "bc9963fb-5acf-4376-a453-db92d627a500", "value": "6144:DPNbLKBwPhcwk84uvs5lowW2rbKp0qr06gVevDp/fffQq4kP:DPN4Mw84csn6Sqr06gVeLp/fffQq4kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762099414, "uuid": "ce8d5d99-a936-4a7d-ad9e-9cde13574831", "value": 219034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762099414, "uuid": "00202b89-6439-41e6-a39d-0bda005fc96a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762099414, "uuid": "e203a034-4a1a-430d-9f03-375dc55bb44c", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed171ab-b7f7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762093593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093593, "uuid": "4af349ff-ecc4-46bb-bfab-4555813452c5", "comment": "Malware payload (Rhadamanthys)", "value": "e7401bd6eb1f674102dcc7e2fa02e139", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093593, "uuid": "bfc8235c-68f6-4fa6-9315-53f32448f2fc", "comment": "Malware payload (Rhadamanthys)", "value": "aac96183cf9070acecf45fbdce6b3923530a10e64b9c29fdf348721ec600d38a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093593, "uuid": "541b77a6-ff2d-4960-8378-df40b91f583c", "comment": "Malware payload (Rhadamanthys)", "value": "4a3b76cd13c7cae7caedaa34989d5f80d92beafc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762093593, "uuid": "10ee3494-9ccb-4ec7-8a88-b7c1662091a7", "comment": "Malware payload (Rhadamanthys)", "value": "65865d5c6b237084ae57278c1606307f5334a1be7d0d5c022b6dbaf8a52083d3ad22cc72089b0d0da58eb30c95f105c4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093593, "uuid": "f54031cd-baa8-4afa-8735-a6abc6f895d8", "value": "T110E57D1AF6A514F9E967C53CC8424906EAB2BC164760DBDF13E04A973F236E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093593, "uuid": "10a26af0-50c1-4d35-95bb-a2f479d5c959", "value": "f9fdf86567c3e457643cc37c1379dd43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093593, "uuid": "65c3a969-0652-4471-9723-cd06ccf5f9a4", "value": "6144:5CneGgxgw+s/uTlD91RUhUarI0oxohDI5lUU1Fx9X6:EevxgQGTlD1S0RoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762093593, "uuid": "d14fe117-2735-4794-88c2-b0eb9f63b9c7", "value": 3145728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762093593, "uuid": "06ab2499-d55b-4ff4-9d4d-a8646df3f204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762093593, "uuid": "fa7e8910-a56d-4184-b790-36ee918e82ac", "value": "aac96183cf9070acecf45fbdce6b3923530a10e64b9c29fdf348721ec600d38a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b154cbb-b802-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762097936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097936, "uuid": "67852395-3684-489c-b796-16f7c5571bf4", "comment": "Malware payload (Mirai)", "value": "e3cb9cf8e5cffd36bddd5488880367c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097936, "uuid": "1030448d-63d9-472a-97f7-3edddac458b3", "comment": "Malware payload (Mirai)", "value": "adf2ac7c5eab648348e741b02298e6090daba2a3f116ea9f866d0cb7f70ee8db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097936, "uuid": "2cc59844-b900-474a-982b-7565a81b79db", "comment": "Malware payload (Mirai)", "value": "02ae796a999a76d59bd14ecc90fdf379059caf55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097936, "uuid": "8f672faa-3555-4031-b802-e20bcf10fe22", "comment": "Malware payload (Mirai)", "value": "fdae91878cdfda1267bdbd3299019363ed1a7994b71d07d88bc2d1ed708d4864e2d4cba9a42e58d6bf2dfd07b6eaed3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097936, "uuid": "5d6638c8-4471-4a02-bbab-d6ddb5478e9d", "value": "T12C73022B1D075F6AE437ACFA27E107051A66232831A3EDC47E2094D78DE24CE3DDA9D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097936, "uuid": "05185ed7-b77c-4c57-9e32-202db7a32951", "value": "1536:FKsciriATpYlfN3K9v+1N7jhOn0pZUuMAmB42c9cVGVJu2cFV8a6Y3PK:KCiA1Ylfw9GMsZcIVQkPY3PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762097936, "uuid": "812e2349-db98-4fd5-bf2d-b24eb26f5ebe", "value": 73868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762097936, "uuid": "0a7c45c6-0dd5-494d-93ad-abc1c1edd5fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097936, "uuid": "7095e6fc-bfe2-460c-a913-c530fff37215", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbd78c2-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072040, "uuid": "79d41676-0368-4676-906a-5eaaaeb204a9", "comment": "Malware payload (Mirai)", "value": "94345b666cb8645c21dd88bde92f0a59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072040, "uuid": "2f3327f8-8571-4a87-a35f-5aee038cc7bb", "comment": "Malware payload (Mirai)", "value": "aeae8a20915a03a680d0ca8b7187ffcb31b7e0444ba3328c018c6f08586ddce0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072040, "uuid": "8cc784e0-a628-4910-a7cf-356143238edc", "comment": "Malware payload (Mirai)", "value": "26132d90961a6565f0b3dd618a052138b38a73d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072040, "uuid": "b1be81dc-227c-4e48-b134-b16739d851cc", "comment": "Malware payload (Mirai)", "value": "793890bf9f3bf98007e590c49d7fdfb64760312a54274711a4fa72211a80e1dae9d9e0160cb22644110c27c7bdba53a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072040, "uuid": "11055c1e-eb87-430e-95f4-631c203bd529", "value": "T1EAA2C026E3C46FE0EE9F8C204FD3D6D2AB658FD616D9C497568F9F01150600AB385EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072040, "uuid": "bb060757-4dd8-4bc9-95e9-7868a845207d", "value": "384:7/JywWc84Tp2YshxqlDZkm0ebEBDqrIpZ02VqS5Hw9CM4uVcqgw05VxJL:7RxsSVsMDZn7IslRD4uVcqgw09h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072040, "uuid": "ebf6e81a-ccbb-4210-9591-4c1e00ecb069", "value": 21892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072040, "uuid": "ea62c7e5-c37f-4174-9d44-0619a07e04ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072040, "uuid": "29c90e62-c303-4a53-9475-f94e530b8315", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313a9781-b800-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762097141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097141, "uuid": "657c234d-16ad-4d91-8b0f-f64709c3ec1e", "comment": "Malware payload", "value": "466fc5d22777060627c0b2373bf1ef93", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097141, "uuid": "e1c6543e-375d-4366-93df-a244c8eb0bca", "comment": "Malware payload", "value": "b01761e05d76245e9f2da39ec9038a670f0ec55376686ebbff54d79222145b5e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097141, "uuid": "2445aab6-c6c9-4c8a-897b-df4e39a5cf4b", "comment": "Malware payload", "value": "f7651cef25a5508c7458c50b2fb6ccca4ae1e630", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097141, "uuid": "ab410789-da8c-475f-869a-5b67079b58a6", "comment": "Malware payload", "value": "489893f439c3f5c9e7ac306d3edad1990da3ca760993124addbe04843525c90bdade377739cfaadc68a4cfb72a8ebd91", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097141, "uuid": "eaf7007a-4d50-4d7c-8d3a-e82181adb328", "value": "T117C2A81B1A5A802688D7D3A2CC9BC592EF3451882441054B33DCD1F7971F1AEFB6BF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097141, "uuid": "7c3555e7-a97c-43b8-8472-04605dc7796c", "value": "384:dSpHfXdTwhq3nwfP5zCpiOSzdgA6VguA6VguFolRdBFolRn+73nw0PgYCogJdj8j:dSpHfXdTwhCivzd6/QFpN06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762097141, "uuid": "332196b2-1545-4b23-9dee-15d2752be219", "value": 25963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762097141, "uuid": "0f89cfee-9d27-4fb5-82ba-37a64c1ded37", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097141, "uuid": "6af76fdd-3761-4f13-960f-54bf8688575c", "value": "Updater.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6db9ffa-b7f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1762091325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091325, "uuid": "409f69f4-1223-4715-9edf-02b31880be51", "comment": "Malware payload (Stealc)", "value": "49e02a4c75d88260d3b9526162cfbf88", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091325, "uuid": "c6fb4915-adf2-4a5b-aeec-2a774f6bb394", "comment": "Malware payload (Stealc)", "value": "b14460c1b9e5d88d6f41d605b88e0de4bbac646b3c578e514bfcff5ba1dd584f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091325, "uuid": "d5a5ce29-fa19-4083-997c-defa8aff0e17", "comment": "Malware payload (Stealc)", "value": "097f6d70e0850d923c5f5f506f3c1c12f88c3b8e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091325, "uuid": "6ba2565b-9cde-4177-aa4f-f752e6c014d9", "comment": "Malware payload (Stealc)", "value": "334f489a962c6396a267fc573b903c650f7e10219f77b0de95fcc4373e20e0028deb3c7c23d8d24a2f58379424dfe46c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091325, "uuid": "7a008a99-35b8-4bcc-86a4-2b3d8416bb60", "value": "T14875230A66D890A6D4792774C9F50297A731B0F01B745BFF34DCC2BD8E216D8AA3271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091325, "uuid": "2db6a1b8-3cde-4152-bdfa-b3cf13a1a7bc", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091325, "uuid": "338b8c80-97e8-41b9-93a6-0c5273b3aa91", "value": "49152:6jf18gf/JfAZgaytGwLMbH81Q5H8udMIns:A8O/5AZgDt9wFHPMIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091325, "uuid": "4e24b06e-e75f-4df7-95d4-8acb49d6a1a6", "value": 1617920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091325, "uuid": "42ab5ded-6c7f-49f4-8c85-b13922db4a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091325, "uuid": "538184e1-7e3e-47ae-9eb2-eb3d99dce564", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ed85a8-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074256, "uuid": "a40b46ed-d188-4a38-a5f4-4709734b0b4a", "comment": "Malware payload (Mirai)", "value": "1875709a06ac77e3ef052e47e13122bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074256, "uuid": "549c9245-cd7b-4b97-abc6-99a7e0583107", "comment": "Malware payload (Mirai)", "value": "b15311baf1000b69657eb2afa15ebe4ad75a0a6a5d21b5d8a9e4a57948c4a796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074256, "uuid": "5d104cc2-b5fa-44aa-a9f5-ca25c08693ba", "comment": "Malware payload (Mirai)", "value": "fa19004aaa8638a6bba13707325440634f13bd0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074256, "uuid": "f9a56f7d-0c97-4cf4-8be0-d79464fd62d2", "comment": "Malware payload (Mirai)", "value": "fbb3fe4489ea4161528567563d5518f48bd055f159c553a168d355076b667071c826c7ef86b12fda022f475b93d7d3de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074256, "uuid": "c81fb676-e02a-4183-92b3-a7f4dde561af", "value": "T1BF03F2238CB2410CD60F953A3C5E4D9CD4506B58AE8995615BE4392FCA2FF74F734B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074256, "uuid": "d3be9e24-6600-4321-a218-9e4215383cd9", "value": "768:o5V6RSJhtQ1ZpDIonoWHnoAvZOZiEDlnvjKozkZ6nbcuyD7UHQRjN:iV6SXa6Z+nokvIv2oz06nouy8HyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074256, "uuid": "92c78890-5b81-45f4-8fe3-042d97fe1277", "value": 39664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074256, "uuid": "e6ed9916-88d2-4f0e-851c-65cba2dff240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074256, "uuid": "f9ea6cd0-0c5c-4190-9e7d-d648cfc59bfa", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84c8871-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074255, "uuid": "cc8cc6af-03fb-4339-bbc3-e82b9eeb5310", "comment": "Malware payload (Mirai)", "value": "e54146767e9d606768c9345aa330be49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074255, "uuid": "6fb57a6d-8b70-4d99-8b44-95c340572f26", "comment": "Malware payload (Mirai)", "value": "b1fb063359fb5a70da5a98f6219d487bc5a8451081a0963995c580f4bbe28099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074255, "uuid": "e840ee62-7f67-466f-a48f-3f2f1aaae15c", "comment": "Malware payload (Mirai)", "value": "a861da8115f672b35817d66446cd59208056402e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074255, "uuid": "4dd14052-bb42-4dc6-88b5-e8309280fcce", "comment": "Malware payload (Mirai)", "value": "10cb2330aa30080db02e0878c5692e77653c5986be8c5527a7e3439ba566cbfa755013392b048b66790d41b9f7b91b11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074255, "uuid": "063403a5-523c-4009-9d4e-0a28aa2d4855", "value": "T122739E37D91A6E60C04649B074F59E741F23A1C482831FFB6AE586B99487D9CF902FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074255, "uuid": "232723a7-b28d-41fe-a023-bf7225b42fa4", "value": "1536:aa0ONhuTIGf13rdIdFaW56KeALA7lNfqjC+qWbs3n4r:aE8TH9rQaWveTTfqjs6in2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074255, "uuid": "6acc7ddb-d819-46e0-a850-f2d54eba0220", "value": 79700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074255, "uuid": "d2bf0efc-6b1f-44ec-9d37-7fb11f93a0e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074255, "uuid": "8c2ce27d-6663-4f20-a211-575edf9e8ad5", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309950da-b7c8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762073088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762073088, "uuid": "1fb770e2-bc70-4068-8363-8a2783b5eeab", "comment": "Malware payload", "value": "1299ea542e9fdb3f52af9f3e04d19ee4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762073088, "uuid": "ba3b4f50-6d54-4ec2-ad9e-dfb5627d0afc", "comment": "Malware payload", "value": "b33a6365df7af41cdb287b37a8c6c40be03b031bd5ac848d324d68aba489ac0e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762073088, "uuid": "e3a12148-f73b-4407-9d70-d88777c54cc8", "comment": "Malware payload", "value": "afcbdcfac750417d11d8e7fd1d1bc8a59155302f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762073088, "uuid": "fc2bbf00-99b4-4dbc-b04b-778cbeb1778c", "comment": "Malware payload", "value": "619aeb403fbf8c1641161998f993b9da5c0b5b74569ded460a2c393a4dda9302cb448106aa6cc8014d7edcd3140c5dfb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762073088, "uuid": "ee18f50b-1495-4404-9bb4-e538965e92ed", "value": "T177C08CA2443CC4B2573A0AAEF241F1F89E17A4284FA03AA1D8698B40E2344701C8F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762073088, "uuid": "b7f49703-cfdb-41fd-b484-14891621fc7b", "value": "3:pKWNFLIx8sv3uy9Fb+dNMfJur2EEtUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfAFebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762073088, "uuid": "ab3ae2d4-ae4e-4df8-a69f-3539cc35c2cb", "value": 168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762073088, "uuid": "91fc2276-d0b8-4e88-b7c7-164978bef795", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762073088, "uuid": "69c4cfe9-612a-47ad-a5d2-f3cb8d769946", "value": "funyvu65of.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be63cae-b83c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762122902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762122902, "uuid": "2882999d-8d2d-4ec5-b071-3f2bf09005cc", "comment": "Malware payload", "value": "868fdcbcc40d4e5d6c5c1b6eb1405e47", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762122902, "uuid": "5ec1b6ed-9684-4b9d-8a58-89ad22377870", "comment": "Malware payload", "value": "b4477c5d31568619cf2c1cd794167b71a2ca78dd3bbc08290c53425ca3a79a69", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762122902, "uuid": "162f94da-ccf5-4f10-9c6a-6733cff6ecd2", "comment": "Malware payload", "value": "bd6def5bb65e49173803f14d0a1bac1e93d90b20", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762122902, "uuid": "bbda4db4-44e0-4f77-abab-5a7f6df8493d", "comment": "Malware payload", "value": "d121b2fce4dc3c4a727ea4b17374b30195b50e0dff8ea2437a2a4ba3971922305f609e3de3a42a6fa0c3bfd0337f0d7f", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762122902, "uuid": "a0bbfa96-54fd-4ff5-a5d8-5d56760f2e41", "value": "T186A312D22D3B6D317DC066381395684D8283E2B632DE3BD83D2B4778F9166C0F6145AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762122902, "uuid": "a8fdffdd-f50d-4f80-a5c2-ea873c9b15f5", "value": "1536:AfrV4f/r7ju11AL7gaRBlZazUllgjllUBfxRfLdkelc8lNofPNKCsgWLPTsP6auo:AfrV4Q8KzQlgBlUBpRfyWvNWP/APTsPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762122902, "uuid": "3444ab2a-6f87-4f9c-97f5-8e2f22c3a5c6", "value": 98247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762122902, "uuid": "17dc2562-9b41-487f-b985-3f9b9c92691e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762122902, "uuid": "ea73f54f-b13c-4093-96b5-321a159a9920", "value": "Right_of_Way_Guide_Virginia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d73c02-b7ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762061390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061390, "uuid": "def51b63-0a5e-48be-84b4-74da127f3929", "comment": "Malware payload", "value": "6c60791a919f36deccab329aad7f633f", "object_relation": "md5", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061390, "uuid": "95fef6da-d539-4308-a582-95b73bdaa6f1", "comment": "Malware payload", "value": "b4dbddaa63e79e4cc91a6abac79ee1f2a9e1fa3ba1af4fe3020a782a5b293b0e", "object_relation": "sha256", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061390, "uuid": "cc234ad0-e9a5-4561-bed0-dac6c3edc85e", "comment": "Malware payload", "value": "9453d3c4bd44ee7438bfa33ca3f4e70293cc4d9b", "object_relation": "sha1", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061390, "uuid": "46a008bb-2d98-4b62-b43b-98f3bcc36961", "comment": "Malware payload", "value": "278148a719ede7ac50499916075cd91ef58b1755a37f1eed39e78a079acd0824f21ad6c4104b8bddc018e3c916f92cd2", "object_relation": "sha3-384", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061390, "uuid": "e4dcdfd8-96ab-4d59-a36f-62a6c1e6cf7d", "value": "T107E5CF21263A53BCDA5E1BF75972C0B890D3C2A53E47D363B20952A7A0D105FB2D1FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061390, "uuid": "b61084fb-78bb-4d05-8548-4914dd03dc52", "value": "39770296fcafe4936a881a0e68c28435", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061390, "uuid": "92b3e901-8bf8-4fba-8598-631bc0358501", "value": "98304:uMCSR7Sf0qMPoSGSuVg/mYtZ5xcTwYiOjmq2pW+yoK15B:uMC27I0xCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762061390, "uuid": "06dab17f-ab83-442e-9fac-0ef81fba570f", "value": 3188736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762061390, "uuid": "563b084e-821f-4381-845f-9354cad18b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061390, "uuid": "fd74d40b-94c8-400f-b728-6fcca6172d9c", "value": "b4dbddaa63e79e4cc91a6abac79ee1f2a9e1fa3ba1af4fe3020a782a5b293b0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2520a88-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095291, "uuid": "35a4ea96-b4c5-43c0-b28a-8522a8e6f318", "comment": "Malware payload (Mirai)", "value": "74c8ce56eb10b8a62a8929e6128a9993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095291, "uuid": "5231945e-7e95-4d5c-93cf-f21b51853569", "comment": "Malware payload (Mirai)", "value": "b51816985fd976856978c849dcbae518727bdc2d5ecd3e9ce60c47d95e682033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095291, "uuid": "084038f7-4927-49c3-901a-bd6041b2f142", "comment": "Malware payload (Mirai)", "value": "5fb625b9281670de3d8d9485e66719b13920126d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095291, "uuid": "d6a70ddf-3690-4b5a-986e-1ca18ab1471d", "comment": "Malware payload (Mirai)", "value": "c3c119573d333a8556044a98e977948111e2a2b4183d69203d29e027d203df157b0d50fa7c8e8ac9d2aed515c61c1825", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095291, "uuid": "95f083a0-9e30-4ef8-96ad-1290f8873dbe", "value": "T1A9735B41B3880D47C1970DB0363F2BD6D7AFE9D122E4FA852A5F9B4691B1A33154EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095291, "uuid": "398c0eca-b86b-4283-b8fb-2df418c9ca1b", "value": "1536:uJE+FvWG8T9mCFwUzQz4ln7IHl+94tCy/f7L6t:uJE+5x8TTRkg7IF+7gLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095291, "uuid": "6e42e9aa-20cc-4462-ae33-5fbbd58dfb54", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095291, "uuid": "db610c2b-10c9-4a5b-93b1-6e3fe39d1a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095291, "uuid": "9c1fee76-b556-4c8c-919c-294f984f2f95", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99252db-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074257, "uuid": "77ad65a3-8469-4805-870c-f974e3096904", "comment": "Malware payload (Mirai)", "value": "68c23d01e2e150ffd73f1b74292223b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074257, "uuid": "7778ea50-cca3-4d67-8456-b96bfc23948f", "comment": "Malware payload (Mirai)", "value": "b51f5c470b96606dd91583bf483632a222dbeafd938f2d0d984ee601f87693a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074257, "uuid": "979d4d09-bf3e-4fb9-9825-c4686f6c62c5", "comment": "Malware payload (Mirai)", "value": "04dd5b6001009df66de57dad0f7dafe4432f9236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074257, "uuid": "cf9e8964-6d78-44b2-8815-5af07ce15bad", "comment": "Malware payload (Mirai)", "value": "d2eb5166cd2924a91d00d565812a6c43ac85836f42040b068639423f0e4d3b4b9d5e6d4114ed7828c1f9e61878671868", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074257, "uuid": "61f0d353-dbb9-453c-b359-263a02daf2f5", "value": "T10B630250BB617F01CCE66D3FE9541989E9A126FD12FA3119AB00CBE4D783981227DB87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074257, "uuid": "050a58cb-e8e4-4252-8ef0-810555a4db56", "value": "768:DwBLm6NZbKRdPce5cq4B3NFyY96yWsSambTjh88YXOxnV9q3UELqYlCiTXd9cCVq:DwYLPPfe3JNFys6yWXsXGoLz4k9t7Et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074257, "uuid": "228a2f0f-f52e-45ae-b5fc-a88c8bb03715", "value": 66816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074257, "uuid": "885b2e9c-8af4-4185-b419-4f38d5e66a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074257, "uuid": "f787d5b4-49e9-4a98-8f1f-aace359cba6a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f776ad71-b80c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762102627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762102627, "uuid": "d8c6938a-3bce-4c6b-9136-2cbfe336fa99", "comment": "Malware payload (Gafgyt)", "value": "dd1a33d7eb908139add20695c010efa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762102627, "uuid": "c85a6c10-d3ab-4d0a-8e50-207bed2a7356", "comment": "Malware payload (Gafgyt)", "value": "b525dcf67637d16f7fa706fe3f09fcb081174b5544a85c5f26966ffa456650ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762102627, "uuid": "6c145818-1709-4a16-b186-479d28e6daa8", "comment": "Malware payload (Gafgyt)", "value": "721a1cd460117d6b15ff1ad3010c67f41fbdf483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762102627, "uuid": "428f7c9a-23e9-4156-8466-f5f5deeab02b", "comment": "Malware payload (Gafgyt)", "value": "c0885fd9a45d6d1e7198f19ac3dad1dd6371b6eea691df882d7b32cd13c405a68550d016a054da9d294aefb80283cdde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762102627, "uuid": "eebf1935-cbec-45fc-b3e6-9ec686dd0550", "value": "T121F33B24E4404767C2D313BAB69E866E3F321BF663DB33115A349EB41FC2B991D69834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762102627, "uuid": "a88673a0-b312-4dcb-bde1-f3b4dee18ed9", "value": "3072:62drhg5iRA4WavPru40Eiype1z5hWBAx6jOgXyxmfQOYbr5Wn:RtWiTWavPrze1z5h9x6S3xmfQOYbr5Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762102627, "uuid": "4b56991d-0724-4efe-82a8-b4387181bd1a", "value": 170949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762102627, "uuid": "fd865ae3-4e67-4c34-b12b-539b339ca121", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762102627, "uuid": "a5e81488-6461-4ebe-a60b-4ffa30a88aaf", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b4487d-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074251, "uuid": "69f8ae4b-16da-4346-bda9-bb1f4996a64e", "comment": "Malware payload (Mirai)", "value": "f7cc33e8d89f4b45416df03fd2a9a746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074251, "uuid": "1675e785-1551-4aac-a1fa-1c39b99ee915", "comment": "Malware payload (Mirai)", "value": "b69161e1bbedab0a7d81474a48398a4c5acdaffa15ea8aa1dcd3e7d4a6c4a48a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074251, "uuid": "6dbff124-8f88-4ad0-86e4-6da16dd6b80c", "comment": "Malware payload (Mirai)", "value": "c7d11b7c826a82f2fc79f89a43ee0d2d6afbeb6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074251, "uuid": "c3dd2c93-c5f6-4e7a-9354-0fa5f9332325", "comment": "Malware payload (Mirai)", "value": "567837b2130f8ed55174a025a8bb49691a4348861001c568e689ee0848419e78489246aebec949f82734e1d8840f8846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074251, "uuid": "6d362907-ceb2-4468-960f-e230903c455d", "value": "T1BB13013C4A565441EBB59EB8DF771A1EAB191B1EB4BD703225000EABBB7344342A81CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074251, "uuid": "fa7f9700-ea68-49cc-bc9d-7738beab0612", "value": "768:dB4+7AKqIQ7VSgcSm1hMDfN6P7BJVqE2GAA/OAUXVcddTO9U7+9q3UELfC:Q+oIQ7VSgHEhpPFDV2GZ2AUXOVeiLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074251, "uuid": "480f8906-cbf0-4648-ab69-a3343fe593d0", "value": 44568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074251, "uuid": "0266e923-d9e0-4bfe-a1f8-1fb0b1518e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074251, "uuid": "cebc4846-83d6-4209-9525-faa560a648ec", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064c397a-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1762095780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095780, "uuid": "0678801d-af0f-42f0-8ce6-23749d1ab1c9", "comment": "Malware payload (Gh0stRAT)", "value": "11de25a5a4dca2ea18592acd26cb8ad7", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fyuu-bing-hk-cn", "colour": "#A1223A", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "letsvpn-dev", "colour": "#6CA518", "exportable": true, "hide_tag": false }, { "name": "uux-27a17mh-com", "colour": "#C81496", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095780, "uuid": "36846838-960d-4c27-8290-8b75193c38c2", "comment": "Malware payload (Gh0stRAT)", "value": "b7de401c758ce95340b9b42d21d86b30e631b001f96834aa02122b38a7bd881e", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fyuu-bing-hk-cn", "colour": "#A1223A", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "letsvpn-dev", "colour": "#6CA518", "exportable": true, "hide_tag": false }, { "name": "uux-27a17mh-com", "colour": "#C81496", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095780, "uuid": "fcea3142-2def-4d40-9e03-78f6bcc9f0fb", "comment": "Malware payload (Gh0stRAT)", "value": "1d7475056a4ab5c87fc75f0a543c96dc5157929b", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fyuu-bing-hk-cn", "colour": "#A1223A", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "letsvpn-dev", "colour": "#6CA518", "exportable": true, "hide_tag": false }, { "name": "uux-27a17mh-com", "colour": "#C81496", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095780, "uuid": "5a05a201-4c2c-4a87-9f7f-6558d73186b6", "comment": "Malware payload (Gh0stRAT)", "value": "76e87bdf6fd754feac358730a0a42ada3544412b2af40019c1c92503f9046704acb1dc2d9e2e76aeb5400031d02a13cb", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fyuu-bing-hk-cn", "colour": "#A1223A", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "letsvpn-dev", "colour": "#6CA518", "exportable": true, "hide_tag": false }, { "name": "uux-27a17mh-com", "colour": "#C81496", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095780, "uuid": "c386f0a1-0279-4573-9105-0e21f35b411a", "value": "T1A9B72221329EC43BE56905B1962CAEAB913CAE360FB054C7B3DC795E1B714C20637E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095780, "uuid": "b117ae53-ef85-4ffd-b200-93bea595be06", "value": "6d5e13c0269946a5a10390c178d8e9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095780, "uuid": "2ba78af1-bfd8-4d06-881d-85032c220eca", "value": "786432:eJqHlyDSs9JRhmSU8LOFw645Dbly+ZbVHUt0m1It7dv/QwqHnDZ8pDxMhmR7vA:eJqHlyDSsLr3Pym6qDblTZbVaXIV1YhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095780, "uuid": "d039e081-960e-4f60-ab85-64fd8acc2536", "value": 48248401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095780, "uuid": "49eeef29-e66a-492b-a91f-41fd42fd1036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095780, "uuid": "dbf6f654-95f0-4892-adff-4db4425faac2", "value": "LetVNP_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3705df1-b800-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762097413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097413, "uuid": "d9ed4dff-8bc1-4051-af07-ed6946ed04bc", "comment": "Malware payload", "value": "af6f4a6ada67c30a87d5852d0bb84aae", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097413, "uuid": "40304954-20ac-4cbb-a551-da57e077e126", "comment": "Malware payload", "value": "b8f851c4de504bfcb0101a2aa272cbe7d91fac8fb52bf1d8b7d833c234017807", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097413, "uuid": "2371f55a-6ff0-40f6-9e87-9dc6614d606c", "comment": "Malware payload", "value": "1b4be061f237c5ca614fc2c366e5841a21a62ada", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097413, "uuid": "0dcc4908-a8f4-49f8-890a-6bf3ff87ad1f", "comment": "Malware payload", "value": "3ac84af06b31c79a376e0f460e70a1934ffa28376b7a1f1178934ff7719dedf8ad99b8be5c250c63157474f5f71c5d27", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097413, "uuid": "c535a93b-ab8c-4b54-9005-af029eb18661", "value": "T182B2A81B1B5A842688D7D2B2CC5BC582EF3451882441044B33DCD1F7A71F1AEEB6BF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097413, "uuid": "6a07edd0-2f13-42e6-9e16-7c1d28398ae9", "value": "384:dSpHfXdTwhq3nwfP5zCpiOSzdgA6VguA6VguFolRdBFolRn+73nw0PgYCogJdj87:dSpHfXdTwhCivzd6/QFjNO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762097413, "uuid": "8b5e8fc2-5663-4f18-9a8d-294d0f1fa7cf", "value": 25486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762097413, "uuid": "9856eaa4-25b4-42df-bf22-a7a5a9dd016d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097413, "uuid": "340eb93d-4622-40dd-a1bb-cdffe165f9b8", "value": "Updater.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc5c52d-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072036, "uuid": "e8b6ed46-1f3e-473a-b832-ce142809b300", "comment": "Malware payload (Mirai)", "value": "f8f42dc030cfe9f6dde790b8efecc3a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072036, "uuid": "d5550727-6cd8-484c-bd50-e758537e11a3", "comment": "Malware payload (Mirai)", "value": "ba37538bd972b91b09cc82df42f0da3ae9e31cca97251c55cc4d6bf1b9cc623f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072036, "uuid": "0407226f-f464-4824-ab03-caff4cfb1432", "comment": "Malware payload (Mirai)", "value": "b613d2ca0ae4e0440c397fde8eeead92dd8f8355", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072036, "uuid": "2b2a1889-0c00-4eb5-8021-b26632d4f488", "comment": "Malware payload (Mirai)", "value": "be905eb478348ac100b2b5cce124414847ab40d32ad9f8f57190925beec1543bb0820e54820a0240873e0ce2d0e28eb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072036, "uuid": "ec627776-e8fe-4dc8-98fb-15d41ec1577d", "value": "T15DC2D03265AE6CA0D3704C3A597DC1556F4B9FBCA0AEB52B790803981AD164A7FDD083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072036, "uuid": "2b850a73-84e9-4efa-8819-34ec463ae3a2", "value": "768:oeFzIGBncjvZcMIVuGAPa7Zc0XJ9q3UELuy:nAvJ2uG6aq5LD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072036, "uuid": "5fd21c5b-9d1b-4293-b72b-289a4b420de7", "value": 27308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072036, "uuid": "49305551-eed1-406a-931c-5a41509aff2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072036, "uuid": "31e7a63d-1506-4909-b2b7-8c399c824281", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804b9c0a-b817-11f0-91c6-42010a9c0006", "comment": "Malware payload (RondoDox)", "timestamp": 1762107152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107152, "uuid": "48de4979-e530-40cb-a748-39d9fc7e3047", "comment": "Malware payload (RondoDox)", "value": "8ce83004cc3457b7f2141c3785113ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107152, "uuid": "e698c6f6-0c8a-47ad-a339-b0c5611fd42a", "comment": "Malware payload (RondoDox)", "value": "bb0069de1a2b09dab1947e8c9a7668c422a6fbc188b41d6808b23f5396766296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107152, "uuid": "a3bfb90f-a800-46b6-8325-49900d3d5e02", "comment": "Malware payload (RondoDox)", "value": "595c97a02596f57b6a29b74d4aed4af1e5d7207c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107152, "uuid": "da9b88a4-3bbb-4f7b-8751-2b18939ad2f9", "comment": "Malware payload (RondoDox)", "value": "84c6f51a89ab32692e617db806664db4c7dc4c6affb82516a177f52cc91b504b22ee0a7874c70191d74ac1decbac5139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107152, "uuid": "170d1957-c606-4072-93ca-ba424ce5392a", "value": "T1BFA32A69FD818511CAD21677FA6D429E372B0398D3FF320B4E294F60679B81B0EBB505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107152, "uuid": "79740f4d-606e-4043-a693-84859d20143c", "value": "3072:1cr8lddbidUFlaNl/lTlgl2l9hl0lElnOl0NlIljl68lklDlTlmlplAtl2lkl8le:1cr8lddbidcUNZZmonhaCtOuNiZQ8+pH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762107152, "uuid": "b8a30bdf-689a-4640-88f9-5403e96be59a", "value": 106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762107152, "uuid": "9336d215-9432-497f-bc77-a56a1b60b783", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107152, "uuid": "63dc6174-ac71-487d-9e55-e02ecd5be4db", "value": "rondo.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2ed0ed-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095894, "uuid": "1ac4da87-fc39-4c36-834e-30a16b073ec7", "comment": "Malware payload (Mirai)", "value": "9ca86caa0ba9adb7b629cc4e29fdd69a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095894, "uuid": "6f7484c4-ec07-464d-8646-34608a78bf45", "comment": "Malware payload (Mirai)", "value": "bbc383eb5e12799b1dbd9cfaf1447f16815959fd5d2aa0c7f91308b375dc68c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095894, "uuid": "4a461004-4ed9-4725-9f32-b31da9cd2f19", "comment": "Malware payload (Mirai)", "value": "72d081ce7b8fe92d1b2aa74dc27055c275a9a8ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095894, "uuid": "c5a5ad0d-8fbe-419f-8b35-b7eb54683f57", "comment": "Malware payload (Mirai)", "value": "5ef294b98a510d3fa4fe77af82d302c9ce7cb6ac4d4c5a9375d723462f80bcbaedbaf4f72601a8c61dfc1860b775bca3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095894, "uuid": "592ca21f-0e9d-4d0a-9a9c-ba05ce0231ce", "value": "T1A903F136C5C24C97D098407C53DA7706AA2025D9D7A4D160BFD8E138DC986A922293FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095894, "uuid": "4e47a301-1644-43fe-af8c-096e800718f3", "value": "768:En3t2V78Lh/eKzKD3LaNDHdDylogIJmNmO85WKeS+1nCnbcuyD7UoQRjoA:En3e89CXwDHdRmNmX9eSKnCnouy8oy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095894, "uuid": "8eaaa3e5-d0b0-4b4d-aa64-030e00034e4a", "value": 39000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095894, "uuid": "c6c715cc-022e-48a8-9b57-b1c2e276a5d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095894, "uuid": "a2deb70e-5f2d-480e-8315-dcef37b1679c", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8803aac6-b807-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762100293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100293, "uuid": "f411f3a8-82d2-40ae-b4b1-c3fb53e53366", "comment": "Malware payload (Mirai)", "value": "e40cf94ea10206c22b6df8107677a047", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100293, "uuid": "dccceeac-0003-4d18-b180-ccb3b5e6a453", "comment": "Malware payload (Mirai)", "value": "bdba01cbfa0b446e9486d55b37340d1347789b88693f6e1c85ed6c02b838b90b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100293, "uuid": "d8ffbdb0-97b1-40ca-97e6-38b329aa699c", "comment": "Malware payload (Mirai)", "value": "8a633229f4682a80812182bf1dd21031d39e89a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762100293, "uuid": "aca078f5-a0bc-423f-8edc-6d8b293487a0", "comment": "Malware payload (Mirai)", "value": "f797a901ccdc8f9a38b6a7db49be4d4265a49a2e52ef01b14b92ad4c96051de461e316df49e6ff04b57aed56c6d3b820", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100293, "uuid": "9f447c3c-a1c9-414a-b504-677128070a53", "value": "T1D7C3295AFC829B06D5D526BAFE1E118D331327BCE3EE7112DD205F2527CA91B0E7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100293, "uuid": "1ca84852-143f-404f-9ea7-8718d1701b72", "value": "3072:8WNqVYqKEqKtC10gnHMylQ8F5ODwOoa4QPlqu+Afm7dhkDAQ:8WQYrEqKtC10gnHMylDnOcXa4QPlquZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762100293, "uuid": "6954f0ae-99f1-4937-a62f-3d65c0a3dc3e", "value": 124556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762100293, "uuid": "fc2b4969-c333-40e9-911c-3bbdcc3c6c2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762100293, "uuid": "a52b7297-c39c-43d4-ab86-69be87e71dba", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1757269b-b7fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762096238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096238, "uuid": "a52f9be5-cd64-48a9-81d9-6126eaf1b329", "comment": "Malware payload (Mirai)", "value": "6859bf17a60fc206ff6378634149a644", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096238, "uuid": "df4c3783-33bb-4032-a6e1-2881ae751f95", "comment": "Malware payload (Mirai)", "value": "c08baf7da4d0aba3d1f154b4e87e35eadd6028f663c8a6ad27c8ad1e943aa0bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096238, "uuid": "61aec4cc-b6d1-4f36-8795-d3c945825c35", "comment": "Malware payload (Mirai)", "value": "49af0bc91c5eeb43ecadb8f32f39ecaef80543db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096238, "uuid": "98784aed-efb8-4a85-b8cd-7b74bb475bb3", "comment": "Malware payload (Mirai)", "value": "82932b964532adb61c14712978446d2b7f307fcff5022d1c542c5ef4e3e4b36a8b2aa33975022ed4a0b56039569353e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096238, "uuid": "a0d09c1d-4e15-4c95-8883-c710336a98f3", "value": "T17CA34AC4F643D8F6FC4605B07136EB379B32F0B9221DDA83E7B85636ACA1641E90665C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096238, "uuid": "18cf857e-64dd-4469-9bb7-78112e7ef1e9", "value": "3072:aDgpptnSv/MsDe80o/5RoSUnrwbrLYDYysU2:aDgpptSnMsD30o/5ySdUd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096238, "uuid": "7f67554c-afca-459d-a70d-eda97992f174", "value": 100264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096238, "uuid": "a2c0a2d2-670d-40fc-8c0a-f7f856810c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096238, "uuid": "381714d6-f9f3-4e72-be85-adaf9fe38b6d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff31acb8-b7ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762097057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097057, "uuid": "69a118a9-d3b2-4da4-a056-f0a85a74a1d3", "comment": "Malware payload (Rhadamanthys)", "value": "b07d0500aaf77da90a66d4f9fec5f194", "object_relation": "md5", "Tag": [ { "name": "213-199-57-38", "colour": "#367D54", "exportable": true, "hide_tag": false }, { "name": "62-60-158-10", "colour": "#1F9D6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097057, "uuid": "37071d85-65c8-4d3a-8a48-6ea5923d2cb6", "comment": "Malware payload (Rhadamanthys)", "value": "c0fef7ea999a22fd9bc8a1a9959f8ede1988cfe3654cce8f26cdc34761192792", "object_relation": "sha256", "Tag": [ { "name": "213-199-57-38", "colour": "#367D54", "exportable": true, "hide_tag": false }, { "name": "62-60-158-10", "colour": "#1F9D6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097057, "uuid": "85accce5-99bc-445c-b3df-0b1bdeb866ec", "comment": "Malware payload (Rhadamanthys)", "value": "4951b856d3d176983fb88f80fa6deb28a09c042f", "object_relation": "sha1", "Tag": [ { "name": "213-199-57-38", "colour": "#367D54", "exportable": true, "hide_tag": false }, { "name": "62-60-158-10", "colour": "#1F9D6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097057, "uuid": "4c15714d-a07c-4d6d-8cdc-d94db031fd6f", "comment": "Malware payload (Rhadamanthys)", "value": "595fe3f8e79183358316ff9a93a41138649d5550f7f8520eef9af0cd6a9e1dd371ed26157288ec8285e8faa4ed8891d6", "object_relation": "sha3-384", "Tag": [ { "name": "213-199-57-38", "colour": "#367D54", "exportable": true, "hide_tag": false }, { "name": "62-60-158-10", "colour": "#1F9D6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097057, "uuid": "f6349a63-3000-4bc1-8d32-135d2e5f8551", "value": "T11BE55C177C930599C079923C8BE25A97FA39B8443BB223D71B507EB83E76BC15A36704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097057, "uuid": "b6d88bc9-6b03-4a71-9c6d-d7cc7190a64b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097057, "uuid": "dfb460d6-20f2-419a-ae3b-a7ca9edcf4a2", "value": "24576:R/znZrT3P3byMXycTGpSGJODOiC0gHzHQXNS18Yz4a3otZ2IXj3G0DjnTTLD/hm:R/75TjyMXLTMSGJODOiowC8YYZXzJ/3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762097057, "uuid": "4a5a2b01-9cd5-42f6-83c3-7ba835959946", "value": 3117216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762097057, "uuid": "0f6a2cbd-e420-4fc0-ba8a-7847e1e90f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097057, "uuid": "492cb368-73ac-4cae-843e-2714df66b690", "value": "xQ4gNK9auvFo4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa5e94c-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103787, "uuid": "8524a4dd-12c8-4580-97da-a737891123a2", "comment": "Malware payload (Mirai)", "value": "a7c557760218be1c5655afc486498869", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103787, "uuid": "34c8eb35-a0aa-4001-b0c3-714fc088496f", "comment": "Malware payload (Mirai)", "value": "c1efb072665b32673bef8f309d22c1304e2073ef2013152a8652bba477b87035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103787, "uuid": "090e5c7a-eadb-4a8c-ba15-237113f1b2d7", "comment": "Malware payload (Mirai)", "value": "401065d5d7cee58187f0740bfe019809d10ad40b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103787, "uuid": "190526d6-50bf-4a31-b185-b83f33f8e8e8", "comment": "Malware payload (Mirai)", "value": "43ad5e460e990cb55115ffc7e3644b9f6b99b7afc3be4ac4ca2d529d783269cb6b873694d6fc383aa3565ac244d72b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103787, "uuid": "6ecf0270-7160-4a7f-b209-85a6b0481538", "value": "T15A63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103787, "uuid": "964586f7-5683-4d4a-9632-91f898b608c3", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAY:UnN4ZH2SyOyuIq8LMMIUq+cvtpvXzDL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103787, "uuid": "9e23f1a6-48b6-41d9-97b8-46b3fb39ccce", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103787, "uuid": "f467da90-e42e-42c2-a165-9af4e9a3db9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103787, "uuid": "7e0e04df-e786-4047-ac19-915d8624c2f2", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01d3cb1-b7e4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762085382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085382, "uuid": "54b32363-1369-4519-888e-e3f71ac0bf27", "comment": "Malware payload (Mirai)", "value": "09462a4b52fbdea650ce85278961572f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085382, "uuid": "4e1be3cb-bbe3-4802-877b-3496b81ac336", "comment": "Malware payload (Mirai)", "value": "c27376e55866161a990a83654e2f1bdc9f9d0d0d0782880eb554a4266694b3a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085382, "uuid": "075b5b68-6db2-40b8-a17f-cc9c4c431148", "comment": "Malware payload (Mirai)", "value": "9c36e01a1fbe3af1f8809629cedc4ec01bef39cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085382, "uuid": "27d80573-e575-467a-8436-5a639f4b226e", "comment": "Malware payload (Mirai)", "value": "d4d85b7ffee3e83cfb8f6dc0fedeb554a8112f5708401cfc36fd5afd25b19ad84badaa75477eb9872e48bd785f46a745", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085382, "uuid": "5ca343df-4a5a-4a8b-af6b-4a6a8f24b436", "value": "T1E893C709BF605EFBDC6FCC3749E91705258C750A21A97F3A7934D928BA0B24F16D38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085382, "uuid": "5b7d9fac-37e5-4e4b-b402-2e1845d90768", "value": "1536:zI5l/XInEdl6gSvs2Xp1dUp7sdV+5xu/th0CYVcSd5OS:zgInKAglp74V+C+Dr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762085382, "uuid": "9b41e1d3-d434-44d3-ad4a-6625e11d0cd5", "value": 92732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762085382, "uuid": "d00886ca-c5ee-42e8-b377-713a8df593f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085382, "uuid": "00ba89ab-df6e-4149-8e6e-96fe5e7834af", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89becabd-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095142, "uuid": "2837896c-8635-4e64-860a-6a30ea3338dc", "comment": "Malware payload (Mirai)", "value": "2ecbf81b33e2bd67568ab7e5e152527c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095142, "uuid": "b0f5965d-df1c-4954-9121-df368fc8544e", "comment": "Malware payload (Mirai)", "value": "c2d8db4267696f339e9689e431671d58f1424a573ff4f1aef7ac7752b67eafb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095142, "uuid": "b0b2dbb2-3c00-437d-9c6e-5cab7c5eb75a", "comment": "Malware payload (Mirai)", "value": "735558259191f0ad94381768ff53cc49dae07d44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095142, "uuid": "ed806f2f-99f6-475d-9757-4fbca841a0f0", "comment": "Malware payload (Mirai)", "value": "6240a7e3c97044732509d3a8cc6c456ca285524ca757d299a1cc2674b9007b7d1c9177a4297308baacb45b048a6bbc7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095142, "uuid": "52acf8ee-3f9c-4ab9-9101-26e7f084c223", "value": "T103733985F987C6F2D4074830426BFB3FCB32D8A510A1DB4DDF969F35DA33502AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095142, "uuid": "f195d607-ea82-42c2-9cc4-eb5cf265b47f", "value": "1536:8A9Uqtm/qzBpt2H29AQmj7qWSICRzBbkivom3aJ2KdLNn:8A9U7KBT2H29A3jnrCRzBbVvfKdLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095142, "uuid": "6b444bae-1d4c-424a-95f9-630e51cfd243", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095142, "uuid": "9bca4949-dc6e-4810-9ab5-89f6d7139bd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095142, "uuid": "2289bba4-c4b9-4b46-ae3b-9a4233b8fab0", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e51e21d-b7fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762096223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096223, "uuid": "2e3eff5b-22cd-4fc1-a8cc-f8cf073f20bd", "comment": "Malware payload (Mirai)", "value": "14985f003cfab63803c44c7248eeae1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096223, "uuid": "bc337e04-efba-47f8-a8a0-5d439add6e9f", "comment": "Malware payload (Mirai)", "value": "c36e89a5709eb885f3b452d2f964a79be1f5d7142c5b41b6ba3c67b5b727c5fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096223, "uuid": "dd4fd03f-e7af-4f36-9ee6-d32a357d821b", "comment": "Malware payload (Mirai)", "value": "b4022903eae025180a1058247face7f324c4e50c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096223, "uuid": "ee3b42e8-7808-42fd-90c4-3f3215e26237", "comment": "Malware payload (Mirai)", "value": "5401d22bfe9080931666a1f2f4b525a5481eaac6e46eaa9f4346500c0dd9975a8fe153a4dfa44fdac97b1d799009cf2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096223, "uuid": "46b9c29e-7363-47de-892f-136e6ac6d04a", "value": "T159243B03B8C18DFBC4C6CAB41BEBA4268923F46D17367247B798FD952E0DEA45D1D608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096223, "uuid": "090a56a8-e1e4-46bd-bc92-34969908b9a0", "value": "6144:OBJH2tix72aY1Rmxds1TIDQd4OSmK6+olSSz8lBbvOow:e2a0/ucSmK6+olSSz8lBbvOow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096223, "uuid": "8ae27203-f55e-4501-a7cf-f24fc4dd9fcf", "value": 215069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096223, "uuid": "7faf6be9-cbbe-4a77-b2d6-f9fd7c8974b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096223, "uuid": "0bff4946-6495-4ba0-b067-cc4b3b537aba", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af914a0-b833-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1762119008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119008, "uuid": "edf8288a-dde5-451e-bae4-86e87677ae9a", "comment": "Malware payload (DCRat)", "value": "ac4d82f073cbd9d856d240f227cb9080", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119008, "uuid": "950aaebd-826d-4559-9d6c-27a6613849cb", "comment": "Malware payload (DCRat)", "value": "c4952e123128e1ed3e24727fcd835d02a993858d36712d27ef5629db88d428d1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119008, "uuid": "9b4d1aaa-f0d8-42a3-aa3f-a4499ee9217c", "comment": "Malware payload (DCRat)", "value": "67ea451a5974562aa78119a61c482d8302f66b0e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119008, "uuid": "de6c1d7a-be9b-4aeb-8e2f-829b2f92c37d", "comment": "Malware payload (DCRat)", "value": "6881e92723d71a33344b05b6dd0cb2e40ff4fecc6e5e2e30bb897832f965a7f0247b44f0611a61632fe584d1c1640070", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119008, "uuid": "eb1e878f-048a-404a-ad53-ce00fbf6c76a", "value": "T1CA95AE1665924E32C3A467758597213D82B0D7763E52FB0B371F6093AD0BBF18F622B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119008, "uuid": "8847cfd9-3820-47c5-b600-08962dd1c16d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119008, "uuid": "649242d1-4b16-47a5-976d-18b2ebb7ca0b", "value": "24576:zylaBiQO1297+EGcuj24VN6kCriQrl4T/zYw1/eIyY/q7jvurJbtBjbvwTqO9UJ0:znBK1Ncw+nhpY/aurJ5drwTt90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762119008, "uuid": "0f514b3b-2d76-41b7-a563-17bd1de9c9e3", "value": 1917440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762119008, "uuid": "552b21c3-c8e2-4d07-8511-ca50a15347fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119008, "uuid": "8955b99d-dfab-40d7-a264-7d3e10b70723", "value": "AC4D82F073CBD9D856D240F227CB9080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af7a558-b80b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762101989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101989, "uuid": "105ce76d-f285-4235-9f69-6a719c17dae7", "comment": "Malware payload (Mirai)", "value": "fd22bc1d8f33ca220e495fb64da5e7e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101989, "uuid": "5735c25c-f6e6-471e-b196-3ad1a466f790", "comment": "Malware payload (Mirai)", "value": "c4a1f4db8f6a5c9a040403905726c6d56d448eff3654765283fd7c768a881a87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101989, "uuid": "03a6db3a-ce7a-4645-8423-bd3963d9e83d", "comment": "Malware payload (Mirai)", "value": "0347334913e149b370f42557c43f954b35a96ae8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101989, "uuid": "930fa268-c982-40bf-acff-450cbb3e1b76", "comment": "Malware payload (Mirai)", "value": "7ec897343ea035db83157c96fa80bbda41a405da5b055a9140db4c9134080eee87297ee8387b47a12b5d779428be46a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101989, "uuid": "3ca175cd-1fda-4c04-8b68-bc2b82aa2704", "value": "T1FCA32895BC829917CAD0137AFE5E42CD371623E8E2EE3213DE255F2137CB55A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101989, "uuid": "bdac5e3c-f67b-4d4d-9ef1-31379feb907b", "value": "1536:Eq7hojWblDbmKtSPedKj+Hd1PepvhVRppXCp+YPpDjwM4NdcEMmT8Ik8fQQgDC:EUhyWBDPtSPedH1P4vhVxYSKETAiwDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762101989, "uuid": "1e0af029-1c2b-4295-b1ec-37cb1c2fc170", "value": 99812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762101989, "uuid": "ab22001d-166b-400e-b74d-b4db4d04310d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101989, "uuid": "5c0b542c-951c-4ebf-8ee1-1359c32b915a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e78a2c8-b802-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762097995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097995, "uuid": "0dd21b00-c3b9-4b1b-bb53-b57bba61c40e", "comment": "Malware payload (Mirai)", "value": "172073438541bbdb4c61285e4e750bad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097995, "uuid": "112e49cc-4cc8-4fe1-b1e8-c4ad2a2ef09b", "comment": "Malware payload (Mirai)", "value": "c4b818b39c95a79f30c6ee8955d8fac5b8c67ac26689d427f5efed24dd8a0935", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097995, "uuid": "7c8937be-3327-4c13-9ecb-d9772bef1220", "comment": "Malware payload (Mirai)", "value": "871a7705f19ac7e0c34ac605872920249503c964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097995, "uuid": "5972a027-98fd-435a-8593-8731d26a5275", "comment": "Malware payload (Mirai)", "value": "ccb6059056866c5e3bdf5b30f37074be47e3f04767a2f681efb0c51911c8fbe6ba22895170f935a5223d5f1c1ec10d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097995, "uuid": "b3364017-789f-476f-a826-f8a5353225a9", "value": "T14B44C70E7E229F7EF6A9873047F38A31975972D617E2D644E16CE6101E203CD641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097995, "uuid": "fdcbca08-3733-48d5-ba34-6e39de6f4d94", "value": "6144:KZsZ2W3D/zWfEguSfy6WqcHyeEy5IT6CF70dD5tZUWi:RbzDXZbLEy5IT6CF70dD5tZUWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762097995, "uuid": "18386f30-c915-42cf-ae11-388630e38280", "value": 256354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762097995, "uuid": "79719ae5-a470-432e-84e5-234079ca59bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097995, "uuid": "72c6eaff-ca26-445b-81e7-791b90136a95", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da974bfa-b7ff-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1762096996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096996, "uuid": "6aef836a-2771-40e8-b890-04faeb183edd", "comment": "Malware payload (RustyStealer)", "value": "57bad85b357231aa14a8e13d24eb4e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096996, "uuid": "305c9ce2-eeb2-447e-9979-01bceabfc36e", "comment": "Malware payload (RustyStealer)", "value": "c50ee0a951654d8e327db3619e01def1a99bb68cb6151412718db27cb0c74a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096996, "uuid": "9c1866da-89fa-4440-847f-30ba04d134f5", "comment": "Malware payload (RustyStealer)", "value": "4be315a3be3406cd58be86410dede0bab19973a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096996, "uuid": "6aff0edb-2115-4f92-8419-7997e6c84fb6", "comment": "Malware payload (RustyStealer)", "value": "f5c036b12008a7816d2460c52c6a2096780ccb4893d977fd731cbdd4ef4d39d6a85f369f2adf284057ee1509a1bf31df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096996, "uuid": "5e46dfd8-0f4e-4738-be08-ff7142cc7531", "value": "T1DE25E0117A7495FAE66BC07971014A129F76BC820720FEAF1694B46C3E7BEF45E2CB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096996, "uuid": "a96cf468-7518-43e1-9d8c-50e419cde8bf", "value": "1a7c3086234c79a6b9ff1bf173fc5752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096996, "uuid": "b8412d8b-8caa-4078-814e-e119b9297377", "value": "24576:E7aZaU8oIOq6Y2AWcqJPGowLJTjPYN4h:6YaU8oxqs3JGoZ4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096996, "uuid": "db312ce4-c33a-49df-b153-95add5351fc7", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096996, "uuid": "0aa02106-42a2-463d-8457-9fac61b38008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096996, "uuid": "a36edb0c-d5af-4aac-942b-1d82e7d2d9e5", "value": "vibrantconfig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d12a55-b810-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762104079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762104079, "uuid": "f0027ca3-b6c9-4419-9f67-57a0219faba0", "comment": "Malware payload (Mirai)", "value": "b3617cb218eb0a41fa003e7012c5f330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762104079, "uuid": "ad362c54-cd08-449f-a220-e8ae721753e1", "comment": "Malware payload (Mirai)", "value": "c859fb70abcebf19c6a2de78bd14869ff719a6cf51e035e8fed52cbc5c506c7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762104079, "uuid": "78bc3914-9c9f-46c7-a0b9-bfd0c2a41ac4", "comment": "Malware payload (Mirai)", "value": "3486e5c8bc261da726e0635d760a019ff389ebda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762104079, "uuid": "58d9bcf4-b655-48d0-b072-c118b39fb186", "comment": "Malware payload (Mirai)", "value": "59d40ab585b87e8fb369ef2d3dd54c3d488e03b927eec8deee629f1be4dc1de03149af39aabc47dd487efea28d4401bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762104079, "uuid": "eaaad430-9c20-4cc0-8237-41f3a069cdad", "value": "T17883027A181FD931D4E034F1D433CDCA2ABD93B1B0F106B3765923DA96ABD0423A5123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762104079, "uuid": "239c63fe-d10e-47e5-9296-5696d9fb01b9", "value": "1536:PHjre9fI+trKbnCzK5EHxfBvlhtwLGB9A/l38oJ7Hi3:PDsfIG+bnBqNhOLqAV8z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762104079, "uuid": "b0a4944b-0e6d-4cc9-a172-69df2da5a0fd", "value": 85780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762104079, "uuid": "75ef01c6-69b3-4ea3-8284-58f00d98f08e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762104079, "uuid": "67b36955-f0b8-4728-b353-0f25539fee6b", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db61049-b7d8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762079982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762079982, "uuid": "ea83b695-eb5d-4e3a-bcdf-12a148aa0b4c", "comment": "Malware payload (Mirai)", "value": "b935726825281616f775277dc7d2f7a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762079982, "uuid": "0574bfc6-e8d5-49ba-9052-d3d1264569e3", "comment": "Malware payload (Mirai)", "value": "c8776b07334ca590530cc5f37587ec5a001b99771df18be29f24ab033a4624de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762079982, "uuid": "a8e2a689-f30e-4254-a9e5-024d6e9a902a", "comment": "Malware payload (Mirai)", "value": "98b57f176c9547399f9feda7af86b4ea02a5b18a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762079982, "uuid": "4c742ffb-9b1d-41ac-85ea-ed875f61c120", "comment": "Malware payload (Mirai)", "value": "88180dcf8664ae3e98c7fd6c1ba8772547110c278197e6e70c2aefde539c6897fd3d0623e091bcf9b63d8e0e8b525852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762079982, "uuid": "1630dda2-3426-4cf3-99d7-32a91c1f059a", "value": "T19C435D02722C0E17C59319B4252F5BE4C7FBE9D022E4F6492A5F8B668A75E371086F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762079982, "uuid": "0b835792-0869-4bf6-ab4a-c806d346c180", "value": "768:jGKMgZkaaRVWYHTvsYOf+7Y2yfaqIt43jQLxt5Sy5Bg6ybMgI5MzVwq:KhPDsYZjyivt4TQLr5E65gIEOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762079982, "uuid": "b95574a5-e1c3-4305-ab25-95226b1523cc", "value": 55740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762079982, "uuid": "b2f9d4ed-c521-4624-a477-d690f2a77cbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762079982, "uuid": "03013f04-f6e3-4448-b325-20136b37e8c5", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efaadb6-b7e9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762087366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087366, "uuid": "8b41b3dc-b8f2-41ad-b14f-ec3c84dd5833", "comment": "Malware payload (Mirai)", "value": "61ecb3880ec05f784be8145242f2ca49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087366, "uuid": "7bfd0bb6-aab8-42bf-a98e-5f4ace9e2bcb", "comment": "Malware payload (Mirai)", "value": "c9079d296d3a513221924c7c4b561f47cb93c38816026bbc0375eb578216efdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087366, "uuid": "56c9aa6f-1d8b-453f-92c7-ac99634e8d18", "comment": "Malware payload (Mirai)", "value": "c1aed6e9a165d057bbffae49d6b0649110358f9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762087366, "uuid": "3983810f-da7f-4e1f-8cb0-39aa166d679e", "comment": "Malware payload (Mirai)", "value": "70733770266bfe40f934aea94f5c1aeab709c406c733cbcbe76c9f7854a737fb016d725d033b9496ac7bb5c3ab342518", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087366, "uuid": "2bf837ff-3733-4c8f-b407-d422a86af888", "value": "T1E4538C36D4596E90C19604B4B4AC8F350FA3F1C883536EBB19E9C2B5A453DACFA05FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087366, "uuid": "7d4b0269-09f3-414f-b4ff-f876a47cc4a6", "value": "1536:VazmmqqpZfjPTAcE1HKmcbAu7uYC9deuC:VcmmqQjrAcOqmQ7uYruC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762087366, "uuid": "b4dabab7-efd7-4b9a-9dfc-012aa557412e", "value": 63904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762087366, "uuid": "221636c2-858c-4a4f-8011-4091d7b2d06f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762087366, "uuid": "7d17c7ec-d3c9-400f-86aa-2224f8934035", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28ca9de-b7f3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762091882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091882, "uuid": "0d5d13af-13c1-4075-8058-1da2cbfd21cb", "comment": "Malware payload (Rhadamanthys)", "value": "d998175470d95c89e7419bedef307b21", "object_relation": "md5", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091882, "uuid": "89c25ca2-4fb8-4b88-92ab-fdedb60c47f7", "comment": "Malware payload (Rhadamanthys)", "value": "c9759d0981f5d82e5aea0e491744f931dff05fab04368f667d11780cfafc7d6d", "object_relation": "sha256", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091882, "uuid": "5cffa414-16be-4c4f-b684-85cf7e154dd4", "comment": "Malware payload (Rhadamanthys)", "value": "42e18a620249b22250cce80ad6a045078aceec42", "object_relation": "sha1", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091882, "uuid": "4151632c-cc36-4cb8-b52d-00c4c13eeb30", "comment": "Malware payload (Rhadamanthys)", "value": "50e968e5d8de6a1bd8273247e2728fdb377bec72d019f225566a90b3055e850441a1ec3291358f9f20c298b2eec93e76", "object_relation": "sha3-384", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091882, "uuid": "6bfc985e-4699-44a0-b8ce-664b8de62447", "value": "T119E7A261F35831351FC1322C03EF793605AD95C337158B5AA929D12EA29B0748BAFBED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091882, "uuid": "9e19feda-7661-4fae-80de-3d2afc9f90dc", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091882, "uuid": "c87cbd21-61dd-4d0f-a4d5-11baf0eb7407", "value": "49152:VjgZIRxCxvFI+jhe7Z/6fGrTQAjNV0uyDK:+Zsx+NFjhetCaQAhVtyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091882, "uuid": "c8dac1f7-6051-4f37-b7c4-ab8438d367f1", "value": 68157481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091882, "uuid": "0d48c846-6e28-4d7b-a1ba-62ccc53d4a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091882, "uuid": "aabbc218-432c-4e15-918d-69da68243c5a", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064981d5-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095780, "uuid": "ecc414af-64eb-4e79-bd79-3f0821c5ce40", "comment": "Malware payload (Mirai)", "value": "717ff13726ac75dc3be8fc56c43cb06d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095780, "uuid": "a85caa2e-9ccc-4c8b-b304-ed880246885f", "comment": "Malware payload (Mirai)", "value": "ce336c605f4b078aa97a7c610cb291b1190da0317cef9a24de4d822a260e176c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095780, "uuid": "3daa3a4a-1c2c-4bd3-9b64-f6f2e51a0999", "comment": "Malware payload (Mirai)", "value": "c02ddeb21aafe78fffe25b939fc08e802202b1a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095780, "uuid": "fcf25dce-3292-40fb-b301-235092b63ca2", "comment": "Malware payload (Mirai)", "value": "61bab6f1600dacf278415eb0f0e9b8fe478a5521cd68f6709a6e0a0a1bfdc8df5a05d56eed93347432d9aa275ece6c17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095780, "uuid": "531829ca-b48d-472a-852a-89906063d6d7", "value": "T19B73025D6B293543C78E85FC601D03D26A4A9450370A331E26FF8DBDDEA58AFA58B270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095780, "uuid": "2b30a274-0aac-473d-81e8-75105851a3e9", "value": "1536:qCIA3QX5hcEC8hWsS5c2LL4gjkoCvSnkNa:qAk65c7g5k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095780, "uuid": "59d49ee9-707e-478e-b90d-7e1775c219d2", "value": 75824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095780, "uuid": "7c7192bc-e226-4abb-84f9-3415de460a5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095780, "uuid": "26ef2cba-ee73-4bc9-80f9-b87356abadc5", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c0cbb5-b80a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762101500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101500, "uuid": "80f88132-75c8-4d91-9fb7-7bf22a302d32", "comment": "Malware payload (Mirai)", "value": "7826b741a8b32315bc3318cf360ef1fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101500, "uuid": "d7b0b6e1-9d48-412c-87fa-f8c0328e192a", "comment": "Malware payload (Mirai)", "value": "cee481b6e3f4c00e79284bf383bc09734dece7375d341020f44bc9c682b8b456", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101500, "uuid": "f5631602-8fb0-4b79-90a8-5f5fb98b4b17", "comment": "Malware payload (Mirai)", "value": "8d4857bf17197926a79ab8802a4358f45251b222", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101500, "uuid": "6b21255e-a70f-41c5-97de-3bab9349e883", "comment": "Malware payload (Mirai)", "value": "695ba24503392432b075d81a6b52eec21af2025dc87a5e599a17269cf32594fed976a78e6cb22f8d29df9bb50e05c369", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101500, "uuid": "9522a289-d925-4527-9b1f-673ecd28adba", "value": "T1E5630113B2292853E7D91C309AAB4FD557330FE1ECA1F2B85B210F416BC928B1570EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101500, "uuid": "9b2816ed-e2b4-4533-ab0c-81e445a4ff58", "value": "1536:1gu2Q9rRiK8YUXPeqzTx/1+/qzIo9zkozw/TGSaMBdFy5:1gu2qiK0zTx/h79VwbG/MXFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762101500, "uuid": "dc3d8e56-b3e8-471f-938d-5fdcfe3b3ce7", "value": 67652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762101500, "uuid": "ef3e7d57-644d-4d30-9d93-8229d1a12fa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101500, "uuid": "8b77dc99-cea2-4ec4-9ff0-e3f4805634ea", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97747643-b838-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762121364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762121364, "uuid": "d95cc1fa-4fe9-4e7d-9604-308d5de90f04", "comment": "Malware payload", "value": "e656e23b6fcb190b991c61c7836b34c0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762121364, "uuid": "a4a17cb6-3e49-4715-a48d-df7a1b649765", "comment": "Malware payload", "value": "cf22e564fe8b24b3a5102826e21fb774c5cb0558978cdf41c06bbc523fbecfc1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762121364, "uuid": "cf447aa8-c539-4cfe-ba6c-f008feb62df3", "comment": "Malware payload", "value": "7bfd9102c60edd1ef969e396a79577d3bd2113df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762121364, "uuid": "e8c478eb-4e7d-465e-8387-bc9563015a3d", "comment": "Malware payload", "value": "486e71d013fe66ddf87e048ce86e154f1a92c5874705a1f7e2cdb71fa99718c1fbc491197cb563dc1e839d92390cb8da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762121364, "uuid": "31b7a318-44a6-4741-afdd-edc876043d07", "value": "T1A1C08CA2453DC471523E0A5EB261F2F49906A4380BE278B1D4198744A2740742C4F73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762121364, "uuid": "ede4c871-dd6e-487e-b44a-dfa6b875377a", "value": "3:pKWNFLIx8sv3uy9Fb+dNMflRTLR+KRHhMitUHeeymHgmQmk0QQHFxaFOd6HhC:kKG9vrbsMfl+KnMhebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762121364, "uuid": "c20272fe-168d-4ffa-b711-f9a804cd5729", "value": 166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762121364, "uuid": "755c4d35-e978-4b49-ab6b-7f8b62ebd24d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762121364, "uuid": "825e9429-6d62-4859-93b9-d6aa4e026874", "value": "8ae29w0tns.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb427e0-b7f4-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762092010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092010, "uuid": "630260bf-e57e-469a-817e-066c8b5cb337", "comment": "Malware payload (RemcosRAT)", "value": "454c6ef6f477a4b3a6106f0c4e5a8bce", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092010, "uuid": "e49f0b75-8d82-4f39-8c2b-8ff6e492a45b", "comment": "Malware payload (RemcosRAT)", "value": "d012a92e43408d373db49ebc99461bf4dbbbd0ab1f7d07d0f96650ea849ac147", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092010, "uuid": "d6ddc71e-76ff-4655-880c-bd779b96df03", "comment": "Malware payload (RemcosRAT)", "value": "d13d7c1d773d08e83889e3bc18ca3dbd5af0be76", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092010, "uuid": "6c870192-d408-4e2c-a666-9f2d422d3b3a", "comment": "Malware payload (RemcosRAT)", "value": "2baa6cce65ca44e453a9fcf2b2328013c099924a435d846f4fc5e614aa434a57c49bcd353e2c43ca0405efe3c84178c2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092010, "uuid": "17d90e80-eccf-4e9e-a860-00f2efc74c95", "value": "T1ECD12B04EC777923A806D5729B0702639C6BDCE7C84475E9B286E33769A6BACF54F009", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092010, "uuid": "d2cb5872-bb46-440a-9a2b-1217bc5b892a", "value": "192:JcjL6VTN0/wCE+f52qUiqqvWsi+VCXViOEbkCB5AWy:JYLQTQp2J8+sPcltoRXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762092010, "uuid": "65527d6d-c408-4586-b34a-f9027fecc664", "value": 6200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762092010, "uuid": "12983c3d-8d8d-4221-b019-f08c34979bfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092010, "uuid": "97bdbb7b-0e97-45f3-a410-eda2add45831", "value": "z12025-D1-05181NoluDiib-Revize.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df4987a-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095149, "uuid": "41364673-9c22-4731-9c76-cabf558cbf5e", "comment": "Malware payload (Mirai)", "value": "b3d4e4bf3e560592c235bdfd1224fec0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095149, "uuid": "4e152c3e-5573-4601-a876-bb45c506f1f7", "comment": "Malware payload (Mirai)", "value": "d08da26f8a4ebadc76a259cdcc80347aa177ffeea9f2280590ff23cf345a982c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095149, "uuid": "5b0aafde-20d4-4ca9-966d-9c43c5fc2f6d", "comment": "Malware payload (Mirai)", "value": "084c212c40a8e7205a16fd224d4966add26b1646", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095149, "uuid": "2b3d93bd-3153-46db-a06a-68e489717e77", "comment": "Malware payload (Mirai)", "value": "e98abdb66060397dd4d2aab542520c91d8d96995107f2e2181900309bd9950ad1d049d29b1f80f569ac2e86f24642ae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095149, "uuid": "46a84688-0f53-4bfd-82b3-49332fe10cff", "value": "T1B3733A55FD814B23C6C1123BFB6E068D3B2653E9E2EA72039E259F2133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095149, "uuid": "61c98578-2aa5-4de6-ab07-6ad33afe67b7", "value": "1536:OZWLxW3i3jV9ZJpcO72Rbu1U+qhxp8f8vNj:OZWLnJpcO72RDRZNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095149, "uuid": "5e70c937-27cc-4919-a7cd-838c6abf80a6", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095149, "uuid": "e87c6670-9bf4-4c2f-9bef-3fb5ddab4a32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095149, "uuid": "7c05dc10-30a0-4887-864c-da85785ca1e3", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7062924-b815-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1762106412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106412, "uuid": "6e42ca71-99a7-4eb9-907e-53402aeea6ee", "comment": "Malware payload (njrat)", "value": "3f3a9f60fc144db5711db0f5299854c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106412, "uuid": "66c5817e-5f63-4478-a871-f526f220fa0c", "comment": "Malware payload (njrat)", "value": "d15d2eb84261207cd71ae7acceb5534fcc2e520e656549d9c38f6b022f9f61e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106412, "uuid": "ab1f864c-b16d-4b1e-9b16-c4313e27796b", "comment": "Malware payload (njrat)", "value": "b9aa7c426472f86a27e78a5b03dd71e7fcdc575f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106412, "uuid": "017992f3-7789-4196-a28c-842bbdad7160", "comment": "Malware payload (njrat)", "value": "99ec1e7cabca9d2114786d1eb471729b09f0e8931d92b8479e73c07e17e2fa346ba9ef1d936b0cd3beaba86a04fbd5d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106412, "uuid": "710f7f60-bfc2-4e4b-ad3c-16070c3b2f46", "value": "T16D54F16D1E95CD42EAD94C7504B3A37CD26C9DB36E0C4903D7687DA82B36E482E26333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106412, "uuid": "cea08d0d-2a16-4537-aa66-4729083ea1ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106412, "uuid": "09afbdd9-ec4a-49b5-bbe8-34fceff3e8d0", "value": "6144:F2wBWoxQniwPPt/uU9/UhcX7elbKTuq9bfF/H9d9n:F2joxQi6h3X3uO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762106412, "uuid": "93166903-c463-41c2-a51b-db2b7437c9b6", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762106412, "uuid": "6861bb48-5068-4b70-a2c9-b4a6cc552261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106412, "uuid": "c6f8e6e0-3ce9-492f-8e17-68e6668b76ac", "value": "soDD-noisrev3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ff9c4e-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095300, "uuid": "e8e7b5e8-d07f-4b49-bcc8-7b53ddc6c54a", "comment": "Malware payload (Mirai)", "value": "f83ade1462fe85ac43ffb541c60be4be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095300, "uuid": "e03bacfa-6f2d-4a86-be6c-58e43becee0a", "comment": "Malware payload (Mirai)", "value": "d2247eed618c42d1043f4fd7181f8f01861d459c14123bb773d9efc0f8afd59f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095300, "uuid": "9ecc8f03-4a53-4c31-8d5b-129cf6451933", "comment": "Malware payload (Mirai)", "value": "a465adda4b09f310f369e768e90e273b147ba714", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095300, "uuid": "1ac8784b-e85f-4e3a-a39d-d291cab56180", "comment": "Malware payload (Mirai)", "value": "25f5197215679ae0e164806bd4e93794e4430e46a16dd2f0ceab86fb848898a0445e8c124e525c5b0baaf157fddb7df1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095300, "uuid": "05476f80-a5bb-4b67-9e05-83862748abf8", "value": "T1CEA3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095300, "uuid": "cd2fa2aa-cc99-485a-9ae0-3b4da524859a", "value": "1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj6bNYK:5ZzjJa1rZ62yqPy/ULWzj6bN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095300, "uuid": "ed12588f-becb-4549-a91d-afaae987e97a", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095300, "uuid": "a4697642-0658-49d6-bc66-bf3c0b51682a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095300, "uuid": "d76786c2-66df-4e09-a65c-661023133cb7", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68534b6-b822-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762112048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112048, "uuid": "3bc869bf-96be-4c74-abfd-80a44c876810", "comment": "Malware payload (RemcosRAT)", "value": "41946617aa20577b958b11089821fb16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112048, "uuid": "181c0356-1a38-4b19-b7dc-7664c0c3a380", "comment": "Malware payload (RemcosRAT)", "value": "d3c8af25f03d15ed3df047f6aecedd3c29c756a2f04d29648874a8f9ef966477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112048, "uuid": "2ccdcd8a-f46f-4594-b16d-fa2cfc1db952", "comment": "Malware payload (RemcosRAT)", "value": "99745dd85aafae7b5d4e763806f36bea6f9c5317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112048, "uuid": "d345bb69-adc4-47dc-ad36-90b99a4f4616", "comment": "Malware payload (RemcosRAT)", "value": "1ebb23015d835dc7261af260074f41ae856b61a84fdb2c57cb764ad7d4b1762c010a9baed1c045fd6015bdcef6b7b262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112048, "uuid": "96a6a618-b1fa-4372-bc68-e9773e9c01fe", "value": "T1E985CF62BE414D32F12E3530D80A67A4652ABED06934F84676FC3E488FFB6937915D83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112048, "uuid": "107edb66-a260-4419-91d9-3364417929d4", "value": "9ff918a4c35fab116ce908921b500295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112048, "uuid": "484b6883-1ec5-46f1-bc55-edbeb563bafa", "value": "49152:PnMNMPXMgmxAWXMojEdx1q9X51tTE0AA:PnoMvMTAWcnxa580A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762112048, "uuid": "e67bd925-8bf1-487f-b535-500719fd70e7", "value": 1730560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762112048, "uuid": "98784b73-0233-42bc-9972-87c618fa542d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112048, "uuid": "48e699a1-3e19-459b-91e7-2be559807e69", "value": "REM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cede795f-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072065, "uuid": "e53eaa54-d3d4-4ff2-8b8e-58bd3c9cc300", "comment": "Malware payload (Mirai)", "value": "b7f9676fee9669ab8cd6b8be1e8c8d52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072065, "uuid": "21a4d5b3-074d-4f20-b7be-653fd42e141b", "comment": "Malware payload (Mirai)", "value": "d40862fb159ce7350ae52746c0785549ae3565cf2abd2220ec548c4e9eb97a0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072065, "uuid": "e094ce04-ac2d-43c6-8fe3-80f3fc68537d", "comment": "Malware payload (Mirai)", "value": "e55bed7daf3a06cbb9ba0a0ca2ef2ffec95f140a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072065, "uuid": "56e6b511-9f4d-4242-b516-767db8d015aa", "comment": "Malware payload (Mirai)", "value": "f0e339ca4e04dca92d9c0b1886cd3e921ee7f1adee0acc4b4304ebe99601eb8283e2416eeb19ae3b02abb484a2ebf282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072065, "uuid": "5cbc68f5-02ae-475e-82dc-6526c1da2708", "value": "T1F263951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072065, "uuid": "4de96ce3-5372-494c-9c7d-ba9cf7db49bc", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatA4:UnN4ZH2SyOyuIq8LMgIUq+cvtpvXz3L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072065, "uuid": "13474997-cd34-4f4b-ac6e-21b808a5d584", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072065, "uuid": "fe7d7ca7-cc9d-42f4-b99d-4614ec047014", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072065, "uuid": "a37e1b89-1207-4496-84a6-2f9176479583", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95982f63-b7dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762081847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081847, "uuid": "0b506935-471c-4230-9720-502988123149", "comment": "Malware payload (Gafgyt)", "value": "e7b570c924d72752c8f1ec18563b3743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081847, "uuid": "60d22ad8-f85d-4cd3-9ad1-a110424d7131", "comment": "Malware payload (Gafgyt)", "value": "d55cb83925f19c5788b9cfc1de5a8b77974ac1dfd8209bf3e67b177f2adc9235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081847, "uuid": "14b55a32-dc27-477c-8c87-c046e8a2e637", "comment": "Malware payload (Gafgyt)", "value": "4323ab22be91c209f10d7790fe61376d162e3fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081847, "uuid": "b28ad675-676f-4e99-9fe6-6abdaf9b086d", "comment": "Malware payload (Gafgyt)", "value": "33765b88197334390d329d71a12f0c104f0405ba6a984ec87a4b90fbce8948cdab2a814fe1e805508f00db84a65f74b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081847, "uuid": "bcf7a44c-5613-4fa6-a9fb-6a970a573b0a", "value": "T10404B63E7D22AB7EE268827107F66F71CB5511D333929392E13CDA145EB224E188FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081847, "uuid": "768552e3-10fa-419d-96ea-6aad1fac2b73", "value": "3072:Shd5rTb0TzU3zuY5hynr/UT4hmv8uqx1BVnKoe:AVA4SY5hynr44hmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762081847, "uuid": "1d6353b5-533e-4ed6-92a7-0081f1133da8", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762081847, "uuid": "7d39f47e-fc50-49d0-b17a-881fd6cc25f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081847, "uuid": "9b7b9591-e71c-489c-923d-76f884f6c102", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa6893b-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074294, "uuid": "cce8a325-7375-4123-a445-e1d8202a7463", "comment": "Malware payload (Mirai)", "value": "7625857a393352ae95986052e7e0359d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074294, "uuid": "99e872ea-ab7d-47f7-a2ac-e7414974fe9d", "comment": "Malware payload (Mirai)", "value": "d5ca10e69eabe173bd0cd6e6fedc144a28638af70ef6601ed84e7f989a8e981d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074294, "uuid": "ae43b173-9818-4db4-9689-fe4c1fabfd3b", "comment": "Malware payload (Mirai)", "value": "fc95766dd919cea2404d9a60500fa74bf7162dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074294, "uuid": "26bc7709-7ce1-439e-ae2c-e6c090738dbd", "comment": "Malware payload (Mirai)", "value": "508b7092b9538a10abb508500aa9e009f79200adc875774330767952d8505d2cafc4ea3631785619c9e0e09ff632114b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074294, "uuid": "5e1aa864-0ce5-4bcf-aafa-62f9a9343586", "value": "T19D7349C5F643D4F1E8970470217BFB375B32E2BA0129EA47D7A9DA32EC62701A50679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074294, "uuid": "2cd6ea02-8c05-4d82-bda8-d001b74c083b", "value": "1536:683XLx+fKMJTjenHtkuimdRIEMSYZGgE3MKr1MfrE19D/z1S7OA3jHGj:6SXLx+CMFjenHKuRdi5s5cKrOfY3xmjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074294, "uuid": "26c1a2f1-21ff-4095-9cf4-ef88c9e3b022", "value": 75412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074294, "uuid": "41e2571c-1dcf-4555-b6c8-cd9078f179d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074294, "uuid": "1adf7521-4012-482c-833e-715e760ea16b", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599b3317-b7af-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762062419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762062419, "uuid": "f3f16f03-cbb0-40c8-8da4-8ba4dc20cd3a", "comment": "Malware payload (Mirai)", "value": "c3e8f22a657ff1d560d3b593996e5db2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762062419, "uuid": "26e1d364-a30f-4756-bcbf-e6737fa48a7d", "comment": "Malware payload (Mirai)", "value": "d6b7b12bc23a5801dd53546d6fdc5865a69a5774c28988d666e034a632ba8013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762062419, "uuid": "48657168-b5b1-4dd1-b43c-538b35da5ca7", "comment": "Malware payload (Mirai)", "value": "2413c09b5a3cd7db833cc681285b6de4c4cc53e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762062419, "uuid": "00cd8bff-4610-42aa-96bb-531443678435", "comment": "Malware payload (Mirai)", "value": "01f7367bc9d039424c5af9953433b63cc15d42b8e760fba3bd95969fd56ad1da3b6923cf6ef991963ed39d18c8392ce7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762062419, "uuid": "cbbd5569-c273-4ab3-b420-a1f291c18d8e", "value": "T103F2F00AD9A78145D24A63F1EDFD4F0B41649C8EBC9889CC36E26C9BB33219C0565E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762062419, "uuid": "a4d546de-0ee3-4ade-b1be-d4d043e7fbe3", "value": "768:Pa0Yy6o6bH6hWjn4dDm44l/a6O0O2sA+iXLfQPLhBQAyNCBl8BQYlIFLW:P16oidWSwBqP7AyNCBJkea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762062419, "uuid": "6166ba6b-9c87-4768-968d-fc6c53a4dd19", "value": 36064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762062419, "uuid": "28c68c47-d8cc-4cdc-bb8f-90d94737a262", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762062419, "uuid": "71746f08-1ed6-4126-b92c-e2fd13af6f5b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58996ed3-b786-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762044808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044808, "uuid": "1b5559a4-8859-459d-af2d-d84564f7b0ed", "comment": "Malware payload (Mirai)", "value": "559f2408df5c508b2b591ed018ce23fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044808, "uuid": "dbff2f54-78be-44a5-9697-11fd514b2d6e", "comment": "Malware payload (Mirai)", "value": "d6c755e34742867d9f66a83a1b522377a37a393e2a56689a2a65924b97cee726", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044808, "uuid": "5739049a-c4b4-475e-8641-3c44c3806134", "comment": "Malware payload (Mirai)", "value": "dd5c0f8966999a2f3ffdaabbf203cbe6d59f4b94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762044808, "uuid": "d4677cea-07a9-4638-bec4-a058f908c659", "comment": "Malware payload (Mirai)", "value": "c1c9da18e4e9bf23a298f8da7f869c7addf3122d0e86dc28799b53ce31621af904b429044b8a71e71b679777ffcb4205", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762044808, "uuid": "39dacc7c-6256-46ae-ba6e-ad4ce781f282", "value": "T15DE30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762044808, "uuid": "b256df51-0c06-4c50-8422-9f21f782f6b9", "value": "3072:ZUIK7GhUWv4Wj4X5s9YHwIaOuxGj5zCm3295RpL:ZUrYR74X2uHha9G/3295Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762044808, "uuid": "b39c573f-d46a-4afb-a642-7959c9ccc3a6", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762044808, "uuid": "6e2a00ea-2661-4fae-aef1-4be026a5e41f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762044808, "uuid": "2f2619ab-44eb-446e-8aeb-759e6cecae8d", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed705af3-b7e3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762085001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085001, "uuid": "0d2cb2b3-9b4c-42b2-ad59-75aa0f736ff4", "comment": "Malware payload (Mirai)", "value": "12590f0a920a0e4fe7aaadfcea17ae88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085001, "uuid": "5f507cef-a547-4364-805f-c8a4e8e38e93", "comment": "Malware payload (Mirai)", "value": "d78f9d77fe0465cba4989f461132b53c200d730f50fb39c67c5f33d25f4e9f77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085001, "uuid": "cead2220-2fdb-4466-97f4-b37a576a99f1", "comment": "Malware payload (Mirai)", "value": "fddacb8885c4c8c551bbba2b193b594a99093719", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085001, "uuid": "7d7ebcae-6bf1-469d-a8a6-465857d12e52", "comment": "Malware payload (Mirai)", "value": "7f34d49bffc45f55e4d75e63071a723a6dee8f78e94572243d3d27e0bb78f239958df4dd80bd2b475d14f870cb2e6016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085001, "uuid": "b305052c-4daf-4133-8356-bf737bbcaa46", "value": "T155F2E185B2042241ED49C671A06B5DE128ECF695D1F293B6EDB876C53A1F502C912EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085001, "uuid": "79f5d41c-1793-4a6c-bccf-1f6f5ef39941", "value": "768:vO42pLGWU+ax0kPWDnv+gNKI3epUqgEitN8c2vVZ8knG/g9ZLpQ/dZ1:G5piWyPWDJNKIepUqgEitmcKb8kh9ZL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762085001, "uuid": "0b9da1c1-9017-49ae-830e-513bdbbdb33c", "value": 35684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762085001, "uuid": "d21b4c5f-9fe7-48d7-9cdc-fe7618327034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085001, "uuid": "759c6867-a8aa-4698-b0a3-32f89fe9aca1", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58e7b74-b7ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762074277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074277, "uuid": "f145ee95-9428-4832-b79b-876318cfd90a", "comment": "Malware payload (Mirai)", "value": "c3d09cd8fb729f883ab2b55349866b65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074277, "uuid": "e6d3df23-b65b-4239-bf6b-8b59c34e2901", "comment": "Malware payload (Mirai)", "value": "d8147d2b23bd4a82cbb564c97c0f582c6c4f23bfd2cb9ec835cd1f9d83bf3278", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074277, "uuid": "d0891478-deb0-424a-80a0-7b133014a684", "comment": "Malware payload (Mirai)", "value": "1e3299a150e496548e41479056a80e9681bb3c31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074277, "uuid": "2bc6ebc4-90c2-4387-acd8-78be1997bdb6", "comment": "Malware payload (Mirai)", "value": "d581b35158ba46b54157284adb43e5eac02e6de2edd5d4a6fa292ccde5d61650d26ebae054ae7a0b0ed55a06a7e52608", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074277, "uuid": "52af0fc0-1c5c-47fc-8ecb-98f543a29da6", "value": "T11D33F791F9825627C2D012BAB6AF968D377173E4D2CF7213D9204B10BB9660F5DA3F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074277, "uuid": "22fd606f-088f-4229-89ae-7c3e23227206", "value": "768:aMmRaUUoRzgbAQBZfxcFWRUXp9B04m1du2UiUHW6Ce0YyQoHywS0e4:h4zgEQi59B1m1du2/aWTKyXSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074277, "uuid": "a5ba2bb2-4465-44c2-b29a-a92d18cb2179", "value": 52744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074277, "uuid": "dbe780ce-26de-4b49-8527-639914b37d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074277, "uuid": "20bb7c73-0535-42ae-a8d3-48967d0fca62", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7383d23f-b7e2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762084367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084367, "uuid": "3b2ef266-7ddc-427b-b34e-e9d4a3133e15", "comment": "Malware payload (Mirai)", "value": "ae018d41d81247da5da0622d0a9261b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084367, "uuid": "a4188ad7-5792-429b-b822-c912dbe754cb", "comment": "Malware payload (Mirai)", "value": "d89dc127027b76f168092f690548e58469fcc255de77d0c8c5192a63ab6e06d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084367, "uuid": "a5c9b0d7-ab22-4499-b933-aa7ac99b425b", "comment": "Malware payload (Mirai)", "value": "de081b96fe7c66f0775eaf84dc8752f2639eb23c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762084367, "uuid": "ca01de7d-4152-4490-8c5d-02e3d60d0634", "comment": "Malware payload (Mirai)", "value": "ac3f6b20d0cb2081b346d09bd24c347101d9312a61a6d78039820129463927359eacae332d844d39d2cdb6eaf92a3667", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084367, "uuid": "f3021de7-a70b-4725-868c-e6102cb3d680", "value": "T176D3A50E3E218F7EF76DC23457F74E21935923D522E1C685D2ACE9150E6438E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084367, "uuid": "e00cafe9-d65a-4121-af74-2534af175203", "value": "3072:ZVVt269dy1lv+CxgTVUpPdHr6kjfbVApfegnzz6O:/V4UAlyTshzZAsUz6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762084367, "uuid": "92ba48fb-1fb1-49d0-8a80-4f2f79d6bcf2", "value": 135924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762084367, "uuid": "fdab0761-2061-4b20-bff6-365e4176ad1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762084367, "uuid": "c2f71c73-909b-462d-8726-4337112a691a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86470887-b7f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Efimer)", "timestamp": 1762091271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091271, "uuid": "3e6c22dd-1eb8-4417-b037-87f96cec7d49", "comment": "Malware payload (Efimer)", "value": "2041540567851af549dd33344d5334f6", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091271, "uuid": "ae55031c-0659-4433-99e2-67a574bf0ef3", "comment": "Malware payload (Efimer)", "value": "d9810ed00ee982d3b8ada30494f7f57c6e51e3878063532e7720e23814e9b225", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091271, "uuid": "0418693f-620b-42e4-89b8-096833dad8bb", "comment": "Malware payload (Efimer)", "value": "7e7c76a8438d5a46656605cb117d7288fab34039", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091271, "uuid": "d06f646a-fb85-42e3-9108-d3bafe4b9d42", "comment": "Malware payload (Efimer)", "value": "788364f5dc9c22d8c5618ce0bdbf2c6cb63b4ce564a30ac5f0a2d327c1dbc9626b87069b40c39f3f19e9a2378814a2a0", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091271, "uuid": "3d1f478e-e5dd-41a6-a011-42dc07f8c179", "value": "T197D63384F7C645E6D8B64179F8E74A958629FC3A033196EB225CB3392C733D1C63A607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091271, "uuid": "23edb092-f28b-4c9e-a50d-995d27ff9a29", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091271, "uuid": "08c09dea-164a-40ff-82b2-8a07319bcb3f", "value": "393216:avjdlfmjTDxtjK0y0bhXMCHWUjGHcuI3/PjuUw8:avjKjTDTByMhXMb8RH/rA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091271, "uuid": "33e50241-cfcc-40be-9dbd-b886b5b51660", "value": 13099302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091271, "uuid": "06e1d27b-85ef-4b3a-8230-19c47b4b7a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091271, "uuid": "91a7deb6-bde0-4af4-b85c-79c7575f68bc", "value": "ad\ud835\udc5cb\ud835\udc1e_\ud835\udc1c\ud835\udc2b\ud835\udc4e\ud835\udc1ck_v\ud835\udfe07\ud835\udfda\ud835\udfd9_\ud835\udc63a\ud835\udc67_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b55f76d-b7e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762086045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086045, "uuid": "c338060c-3eab-4cc8-bb23-d9a333abe4d0", "comment": "Malware payload (Mirai)", "value": "d9478a21268c04dc2ed0792dc19d6748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086045, "uuid": "ca1d773e-01b0-4672-83df-77d83c9be218", "comment": "Malware payload (Mirai)", "value": "d98c64d74905cbec1f5693b63022dd0fdc34a0cf701def311bae5f2c7df2af4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086045, "uuid": "cfc165d1-49af-4714-bb83-2be24d8f5f1b", "comment": "Malware payload (Mirai)", "value": "a87c4c6aa862f325c165f6922dea2b62218565af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086045, "uuid": "3662cbc4-369f-4f56-a1e6-64403cce6856", "comment": "Malware payload (Mirai)", "value": "d4209d8c0fa89631f8bbea8612c6b09c6f72abea122cfffc1244ac9b59dc413698c1079dff7d91512af7fd50a34f9f7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086045, "uuid": "471fccc4-ccb2-44f4-af01-764e6f69c7a0", "value": "T1DC732A9AF801DD7DF80BD6BA44574E0AB970A3D002830B36276BFDA3BC721A55D17E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086045, "uuid": "003bb11b-9284-419c-9443-38282b7b720d", "value": "1536:JHr4Pzcxrlp688FyU/x64AV/+5LTLQdVG406T:J8Pz0hp6GyA1+xb406T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762086045, "uuid": "ac6ae3ef-a047-484f-8f1c-f2b6a87795c4", "value": 75808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762086045, "uuid": "e4013b3d-f994-4b61-af0c-464f96a2cf26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086045, "uuid": "4cc6bba3-c4ae-4330-88cf-6e77e589e2fc", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003ee2b1-b7f4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762091905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091905, "uuid": "370886e9-b8ea-41c8-9900-3ddc86b69d5d", "comment": "Malware payload (Rhadamanthys)", "value": "ec959ce4eea0a762ae4b7e5dd6538aba", "object_relation": "md5", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091905, "uuid": "5a8cf4e4-671f-44ab-b945-d7f775be0a13", "comment": "Malware payload (Rhadamanthys)", "value": "d9f4d8365c1f4caeff171e712ba32a7e132b12d9f1232a7ada4f1385d15e2007", "object_relation": "sha256", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091905, "uuid": "b48ea208-acc9-41ac-a225-b9efd8a8a1e2", "comment": "Malware payload (Rhadamanthys)", "value": "9ff801dde14ef7dfbdf3d52718eb1fe3a583aa1b", "object_relation": "sha1", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091905, "uuid": "103c9fbf-5341-458c-896a-843f747e8d8a", "comment": "Malware payload (Rhadamanthys)", "value": "170b2b73426b5fe8a35cc8c3c9fad9fe4c2a76c324fcd35588041d735cba10a15e4df9fa8ce3a974183d972d0648e0ff", "object_relation": "sha3-384", "Tag": [ { "name": "23-26-237-117", "colour": "#C04AA9", "exportable": true, "hide_tag": false }, { "name": "23-26-237-237", "colour": "#872BEA", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091905, "uuid": "2466cba1-1c0f-4289-81e5-ae4c4645751e", "value": "T1EE75236A57F8643AE359837442F5900B6A30F8607FE453EF2AC582B96D717C1AD32B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091905, "uuid": "62c28672-e679-44c6-a2bb-32ddb6f5fa15", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091905, "uuid": "941f1ea2-032a-4a66-8b46-0f0aced90526", "value": "49152:VjgZIRxCxvFI+jhe7Z/6fGrTQAjNV0uyD:+Zsx+NFjhetCaQAhVty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091905, "uuid": "cb1401df-e367-4166-9fa5-f033f40c16fa", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091905, "uuid": "acd0e1ed-f28c-44a3-a576-87102245b586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091905, "uuid": "d85017b6-ddba-4d49-8e1f-a19d2c40e33b", "value": "Setup_Pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139206a8-b7e6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762085924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085924, "uuid": "096b5e62-3109-4ecc-b549-cf39684fa14d", "comment": "Malware payload (Mirai)", "value": "3e4495a480cde2c218a5102678f38767", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085924, "uuid": "5d8a12a4-c454-41bd-9373-b61315921dde", "comment": "Malware payload (Mirai)", "value": "da2e328f413c0d5dfbd00124ac52c233214c0201d98928802821c2872c41f3f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085924, "uuid": "f39a20cf-077e-41c5-8bfa-e7939a6a9563", "comment": "Malware payload (Mirai)", "value": "19c9ddeb296232978ddc168c3839a82eb33f6227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085924, "uuid": "1506969f-7f23-4cfb-b498-1204d37b7842", "comment": "Malware payload (Mirai)", "value": "a63ebe33e828bdede710e3794721405f10b502c2924b77bd94ac7f562fff1c34143e3ef872a82cc847896921bcfa95a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085924, "uuid": "15b4b9c7-4414-4462-841d-ea7541fb7a97", "value": "T149D3AE9BB30B4811C47202F01BD79F8E3E6372528E47D9FB2E09663B2C795DB1946782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085924, "uuid": "393c067f-8677-4245-b903-1eb6ddb4bb67", "value": "1536:WEZKLue4d2Ih0oWS2mmsTOujQuL02Q+6agJnMe0lckYphJmxNqogcnI/LWa:Wpl47h4ZujQmLfAJnMfXYphJ6gcnIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762085924, "uuid": "144d79f0-dffc-4410-a237-75fee0a92e8b", "value": 132476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762085924, "uuid": "649c0a21-a581-4c14-b1dc-fc8b9e45a209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085924, "uuid": "709b39da-01b3-4071-a1e0-bac17de6972b", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924a751e-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095156, "uuid": "c92bd295-dbd0-4dca-8a35-03bc00867074", "comment": "Malware payload (Mirai)", "value": "9852456ff80cd7dbc34a8750ef8897b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095156, "uuid": "11311a48-a461-4d0d-aca6-2d84833acab6", "comment": "Malware payload (Mirai)", "value": "da54b25a55739f661919dff4d9c055b02cb413fd021b183daac4f45709b805d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095156, "uuid": "03ab43b2-db67-437b-8e58-e4d6c309d139", "comment": "Malware payload (Mirai)", "value": "037993899cc7984db1d16f6b11dff17a93563a2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095156, "uuid": "f1012bda-c351-4048-9b7b-e99ffb2beec2", "comment": "Malware payload (Mirai)", "value": "088eed4774a0565894b0d0b040d8b2fc39a01fcc3a153817ba9546ff8b87f2fcb40da2273c0cc32882e881e636892601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095156, "uuid": "86976805-fd47-47c0-bf37-1575a60efbaf", "value": "T110F33A46F6418B13C0D61775BAEF420533239BA4E3DB73069928BFB43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095156, "uuid": "df8c84f3-738c-40c1-bf4a-8ab8134945b2", "value": "3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjJHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OJHDj1M/9V03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095156, "uuid": "eb4ad218-4b8f-4684-9e5f-f4f8f9d6f8e7", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095156, "uuid": "54191434-b92d-436b-9773-98bbc64670b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095156, "uuid": "05a5bc6b-f2c8-4a7f-8711-fd0ac434ae2e", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5431b908-b7e1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762083885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762083885, "uuid": "906ee2ba-e753-46ef-a0f3-5d415f68e6b4", "comment": "Malware payload (Mirai)", "value": "cf9cb35b48f987f4f14e80c5430499bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762083885, "uuid": "38d8685a-2d91-48a2-aba4-b43192b1e9ae", "comment": "Malware payload (Mirai)", "value": "dc416c6b4c495ba19e242ec5e21e3918b21498e0d5a97d75a3d2bb0b4bc40f5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762083885, "uuid": "da8b318b-88a8-434a-91aa-ec74a6e4c912", "comment": "Malware payload (Mirai)", "value": "7202eca0ba31344f7dedf4d57afe23653f5b3b1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762083885, "uuid": "171c49d7-8030-480d-b83c-aec97895782f", "comment": "Malware payload (Mirai)", "value": "456b0244f9161aa4d23ec9717c8f9147f4350a1d6c23ffe4c031848cc3785a38dbeffa1bb54e06c5f4396e7885e08f82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762083885, "uuid": "bceb3a10-4d8e-447d-b374-ecef27ca9ee4", "value": "T1E8B32995B981AB15C7C3567BFF0F028E331657ACE3EA3213CD295F6036CB55A0E2A446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762083885, "uuid": "468231ee-9f07-4500-ab8d-302d02d5b854", "value": "3072:8N0XAd7IAp0deacZpSmdJdPOFNU87lFMpevzJAbPaFm/UnRPIwBVn7nz2L:3XQ7tp0deacZpSmdJp8G87lFnvtUzoRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762083885, "uuid": "3d68c50b-88fc-438c-9c8e-b571cf10de39", "value": 110956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762083885, "uuid": "2ce530b1-6e73-4ff6-9462-ce440f9c3658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762083885, "uuid": "695fe76f-d6bc-4abf-9cb3-fb165d95b2bc", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8b04ef-b7f2-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureCrypter)", "timestamp": 1762091308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091308, "uuid": "4efc9cb2-efd0-4bb9-8e11-b60134aada90", "comment": "Malware payload (PureCrypter)", "value": "e261f4a461b36d8b3ec3cd72296fd7bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091308, "uuid": "e85ac405-7bce-493f-a5d9-02cf161be9ba", "comment": "Malware payload (PureCrypter)", "value": "de18b986a43e2e32f160db020b3247212335c981b06019e430c14e10077dd867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091308, "uuid": "22d90fd9-e856-40d3-82b9-a32ce68d5a19", "comment": "Malware payload (PureCrypter)", "value": "0c23b53c812c398d699575b6c2db9c9652ac696b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762091308, "uuid": "1f1ca348-8354-4d02-8036-adeb7a70f4d5", "comment": "Malware payload (PureCrypter)", "value": "e4488a3dac2f7b042b422d967a432b4dc58fbb697f2b4bc103e586b9263278d55275963ee784b118afbcb27dee4734d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091308, "uuid": "f204ce1f-12d1-48cb-8ee7-6eeaa803c1fa", "value": "T1D0363379592EDB84C12B087CFB34E6497B9A06D2CB4CA788CA8532873FC51DA397F115", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091308, "uuid": "6b1f2a11-111e-4da4-b68d-c0a7e11e40f1", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091308, "uuid": "2605a765-7595-4d4b-b6f0-bbf822f19f46", "value": "98304:50T+8+9BDrxzLQOXLYF7LHjr4bygrKFMXOc7p4X/exTSgUEyIab/w:uKZBHxLQOXL+7jjcbyQucCvex2gUEyIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762091308, "uuid": "a7e02dad-78b1-4c3a-b519-7dc0248aaba0", "value": 5289984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762091308, "uuid": "130fcf14-3a68-4ece-81ec-ee0a4309db58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762091308, "uuid": "032ee7a1-58c6-4f7c-b166-7c15fcfb9506", "value": "Installer_v5021_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79944969-b7cb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1762074499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074499, "uuid": "601f7eda-fa43-497d-9a6a-b00a87fde34a", "comment": "Malware payload (Stealc)", "value": "92f0b4f63250012b57c637f089f2ea5c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074499, "uuid": "356cabea-1bff-4efc-84ae-9b5e31af10f9", "comment": "Malware payload (Stealc)", "value": "de8f646b88e1d97e680c9ef207f3cb03b08934f02805e495c0d6ef1b8a861d1d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074499, "uuid": "d76d1659-b0d0-487a-a24d-67316b1bb2ae", "comment": "Malware payload (Stealc)", "value": "98b2ba3c7c29e032ce7ee1961dcd3b4bf07a4784", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762074499, "uuid": "ac2fb322-9024-4e31-b36a-f2aec5900539", "comment": "Malware payload (Stealc)", "value": "1e8245c54ad40ae1ae704f7f066d4805586b9fcfc7a8d21a9847bb51daefca9d8117fcd044a026df797a5f89e2c90144", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074499, "uuid": "3cdcf2f7-42e0-401c-895a-5277df587c32", "value": "T118F48D1FE3E501F8C4BB8178C9625956E77A74565370E68F03E009A63F2B650AF7EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074499, "uuid": "dc071dcb-4a4b-473e-a4d4-f4466f1126b6", "value": "112f19f28f55f461c3d7ad7d3898dd7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074499, "uuid": "2eeac6a3-6685-4fa7-8475-35f66a288ef4", "value": "12288:XwVOm41h6aMIChNqge8bNqDVqlPjzad0HbCWv3YZtF15kjHx:X2eMBThN9eiyVqlPjzU0773j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762074499, "uuid": "95ca8d03-452b-4612-8006-625c0177f432", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762074499, "uuid": "884b60cb-b8b4-4053-a793-2146237b9f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762074499, "uuid": "ca14aa62-8226-4f9d-8978-f8395dcec07e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ef8bf9-b803-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762098429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098429, "uuid": "8edf0073-3ad2-4dc2-b0db-9226ae65abe2", "comment": "Malware payload (Mirai)", "value": "efef50999237b16217e3ddcf76628250", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098429, "uuid": "bcd7d255-8134-4b9f-bae9-bdaaeca0c9bb", "comment": "Malware payload (Mirai)", "value": "df392bd9c0bd99bde12716ff46b3044c25852cb72411463d40e66a8019b06ff3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098429, "uuid": "416c5f1a-1f4b-473e-ac21-97a4fdee8ef0", "comment": "Malware payload (Mirai)", "value": "bcd858c1e28c058ec9e0513a08380fa5e7fe457a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098429, "uuid": "e32e22b5-437f-4f96-8777-e0f3a4bd8f4e", "comment": "Malware payload (Mirai)", "value": "3c869e4f28efb698e2865d7f062dbb7e3f0740a794cadbb5a0dd08bc11a08065621878f05bb17b21804e8d928f045545", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098429, "uuid": "c5b190ed-635a-4f84-80c1-d9fff98ec620", "value": "T1C233F258F0E20534F1DC407C5CBA79DB5F045389A66EA127BE194074BA5EFBD28AC3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098429, "uuid": "a4731021-6719-4b1b-8d10-50ca9e5264f0", "value": "1536:TPBO7gNzvC/b/0KwOlrjQ8nouy8oyDLygnQCL:T5pzvCTr13outFVQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762098429, "uuid": "9e0a7abc-7a47-45c0-853b-2931bc85b767", "value": 50492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762098429, "uuid": "7c90d151-7a93-4138-b7cc-4411db182d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098429, "uuid": "a4e325ba-b04f-4e75-b4dc-8deaeda8bd03", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0071586d-b7ad-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762061411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061411, "uuid": "53503c4b-237a-4f0e-961c-173ff9100158", "comment": "Malware payload", "value": "dafeb6dbe3fb816f08df815de6938742", "object_relation": "md5", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061411, "uuid": "197b32c1-d299-4129-b890-560015173e94", "comment": "Malware payload", "value": "dfb5831a4b7b37d28c9022019907d292fafe488f9675cd15bdb012afd0bd5179", "object_relation": "sha256", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061411, "uuid": "58975f74-f27a-4bae-ac4f-7e3aff8cb3f3", "comment": "Malware payload", "value": "ca8e2d99b00e199a7787ee13e79eb1aeea98f98e", "object_relation": "sha1", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762061411, "uuid": "c4b7949c-4d58-4ba6-addb-1756c9e49e12", "comment": "Malware payload", "value": "f2c8f95f8e090e04ce307f280e11af0aa6423dfdb31de0cfa8b1a78650f427106d557c36c046b132dd7e0124d03b1d35", "object_relation": "sha3-384", "Tag": [ { "name": "179-43-176-110", "colour": "#0E9C30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061411, "uuid": "c0554a0a-05aa-4d3b-8e79-7462b472af17", "value": "T1DDE5CF21263A53BCEA5E1BF75972C0B890D3C2653E47D363B20952A7A0D105FB2D1FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061411, "uuid": "3285d8df-cce7-4eb3-b0c4-8f70fbd868da", "value": "39770296fcafe4936a881a0e68c28435", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061411, "uuid": "51469000-bdbd-49c2-8399-d56a2849a03e", "value": "98304:8MCSR7Sf0qMPoSGSuVg/mYtZ5xcTwYiOjmq2pW+yoK15B:8MC27I0xCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762061411, "uuid": "11dd2ab5-7477-4acf-94a6-2befaba31822", "value": 3188736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762061411, "uuid": "9e9f786a-f5b4-4462-8fcd-cdb2bac06e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762061411, "uuid": "640a37c6-e858-4d93-8238-964b37b33bb9", "value": "dfb5831a4b7b37d28c9022019907d292fafe488f9675cd15bdb012afd0bd5179.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379ed1b6-b816-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762106601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106601, "uuid": "c59cdab2-425c-4b48-8fe6-bf353fd2b094", "comment": "Malware payload", "value": "634a6b9edc7c41c2f4796851fa194752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106601, "uuid": "10d9b53e-f10a-4c9a-ac70-5d7957c34e58", "comment": "Malware payload", "value": "e143e72541d710a377db83b1a71968648e8ed280ab9a5ac02cd2678963001fef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106601, "uuid": "1c2200d0-36c2-4537-b110-6f5e97c5f51b", "comment": "Malware payload", "value": "04c8b61139ec72b6e590e3a402cc26a69b7641e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762106601, "uuid": "baf5b17b-5858-45c4-8e83-34883b55ea64", "comment": "Malware payload", "value": "89d2c03a3d694ae7e8a1960359c1cd616cbdbec6c18ab7ace10b7a4e84316a7cddbf49dc333573564b21cb61569a2f8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106601, "uuid": "66993a5b-222d-4bcd-afd8-1bc8369e577f", "value": "T154D3C50E7E218F7DF768833847BB4E31979D23D622E1C685D16CE6115E6028E741FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106601, "uuid": "048ec06e-c750-451c-ab9a-1979099d4556", "value": "3072:9YE5c48OXWhDmG2WeHv2nvQ9PSnA3AVr/VdqGJDZ0A:x5z8rBCP2nvQ96ndttMM0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762106601, "uuid": "d7c2c990-dc25-4343-9f5c-25914af03c90", "value": 132084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762106601, "uuid": "9cdb2f6c-83aa-44fd-917a-6f70e53599cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762106601, "uuid": "1db2df48-e224-4c6b-9fe2-b45c7b2a4600", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4988cb59-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095893, "uuid": "7b4041de-d07d-4b0d-9ca4-27f9d18dadbb", "comment": "Malware payload (Mirai)", "value": "038de3694e3d5b577c6606856bbf461b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095893, "uuid": "44fede41-92dd-41c9-b28e-ac1aa11867b7", "comment": "Malware payload (Mirai)", "value": "e1663addf1949e6c8bb2105940f47175f384da687a5a317a9070d99140c3c593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095893, "uuid": "05324b6a-5eb1-4820-acc7-18017477e588", "comment": "Malware payload (Mirai)", "value": "3aa34eb6bdbba05949af7d551477e5a884a51235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095893, "uuid": "503632a6-be23-4805-8a15-9f8bd75f44af", "comment": "Malware payload (Mirai)", "value": "d8054b5481df9e45117b0175e01765644489c5a3a923267fc300752f54f99e538ba167d84224b386a9bf76fc70ccb7f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095893, "uuid": "11f930f2-6d2f-4c33-86eb-c0e50296a073", "value": "T1026302CEA273D43AD53936BD44E8CC84EDB2B265EA090BDB0192111F893FA7D1B509D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095893, "uuid": "8edbc298-3540-4526-93c2-7f1b2bfa2cf1", "value": "1536:YjcD1/KfkCGvTUkxASGjesZMPTaEyV+FSPHzFZ:YID8bGvTlxkMTaIFSPHzFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095893, "uuid": "c1934556-7bcc-429e-8d19-5759d1f6f16b", "value": 69808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095893, "uuid": "bea61240-011a-4df7-96bb-a491e5aa6f07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095893, "uuid": "a0ac91c0-c39b-411c-940b-8cfa0f75fbce", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d683f09-b7c6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072304, "uuid": "78344f21-2339-47be-a616-4713a4c6c9c7", "comment": "Malware payload (Mirai)", "value": "f0dd01c2eb696bf593130c5b0ff50dcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072304, "uuid": "1076cff9-2063-4297-b818-8b4afb3979ea", "comment": "Malware payload (Mirai)", "value": "e44047e068dc41434326a8fbcdf19af85becbc9a09586ab604d0371fa1b25bc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072304, "uuid": "548ea099-c88c-4bb3-b4b6-88ac7f94c3ba", "comment": "Malware payload (Mirai)", "value": "41e74e56e8cc879fa3d99d4b42feb906604ae411", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072304, "uuid": "e7ed810f-a460-4ada-aa1c-fa321b346962", "comment": "Malware payload (Mirai)", "value": "5959dde86b898aa8154af7c949322e7c7294e941f26149e4f08a34dd74a32aebdb9ed7e0de0f7998b182293036a8a6f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072304, "uuid": "4566a740-ad54-4699-a597-f8b4f2b9227b", "value": "T1CC2308C8E443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072304, "uuid": "f36ec2f0-b657-4703-940e-453e0ccb5027", "value": "1536:6nJRT4QPfZfW5XTOeY3DvefAG5Fh/4Qw7bn2ise:Gv4QPfZfW5XTOeo4zfhAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072304, "uuid": "cdea942d-c579-4c8c-a517-b90b83df69f4", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072304, "uuid": "bfebb2b1-6e7b-4549-a512-9d5ea29d9933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072304, "uuid": "c938063d-d3f5-48b9-97a7-1db4ce8ef83f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a730ca2-b7aa-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762060166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762060166, "uuid": "909c6dd2-0b05-429d-9342-745890df3415", "comment": "Malware payload (Mirai)", "value": "fac16dae1714604e322c6e57402be087", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762060166, "uuid": "b5298863-fb29-44dd-85b5-450f34db33a8", "comment": "Malware payload (Mirai)", "value": "e5fe56a5b53053a1f103933b88da63d8ba34375521b0eaed8d55f8e643058b4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762060166, "uuid": "105a1ddd-5632-4b82-8935-fc5decacd2f8", "comment": "Malware payload (Mirai)", "value": "0ad5108649ffc5c00f7e4f54d43920c0551066be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762060166, "uuid": "2a7be298-0aba-478f-8f34-de8eb2f76b60", "comment": "Malware payload (Mirai)", "value": "97cca6be3012329e16b86ab55185c7af9acd7fa664c007c6d08d78958c5b203300d19d415d56bf92abeda0136883f641", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762060166, "uuid": "87559d30-4421-44a8-a90a-aa3f25bbe5fd", "value": "T1C203F1F8BA494C7AD7135572F32AD6EBBAF74B613479F19A34C1944A2E28E23044C139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762060166, "uuid": "9f63a822-c595-48ec-96d4-d5e531637263", "value": "768:eDoDuxjX+PnBx57hMzLSfWK1Fv8CJHcpd99aE0BFY7Nq3k9+NfbxiEKqNvkpF7Bb:eDHJoBx578SOQv8ucpDQE0BFYBSkSbxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762060166, "uuid": "bb6e7634-102e-406d-8ee3-25e74c2d67d3", "value": 39380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762060166, "uuid": "ebd0f2bc-7448-496b-bd2f-0f7d504a5c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762060166, "uuid": "1a7565b0-81b1-447e-8602-08536f090590", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be70f227-b7c5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072037, "uuid": "f7ef05bb-d035-456a-acff-19e77b808615", "comment": "Malware payload (Mirai)", "value": "3c169fe56b14170d28ccb8d6da79fa86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072037, "uuid": "ec70a3a8-3d34-4f36-b7c1-e836fd4aca7f", "comment": "Malware payload (Mirai)", "value": "e8d17215e7e16d993ab7463b4cdc341d7c69dca08e17435fc2fb8c4876bc87bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072037, "uuid": "d70606a6-1ba4-4f8c-80d0-5a6cf3d6ce25", "comment": "Malware payload (Mirai)", "value": "4843e84f093999bdc5ea1e07e8b8bde1f49a2ac9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072037, "uuid": "dbbab7c9-e3d1-4ba0-ae4b-c6d0aa349a98", "comment": "Malware payload (Mirai)", "value": "664cd6ca5511329586e2853897292a03a5620017e904981d1bf4002b019a61f645a661769943102c4ba16b2e2e025132", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072037, "uuid": "98d9bb19-b702-46b4-a789-223321536b6e", "value": "T11CA2D1709716B8B1C7F04E35DF678687AD57083093F6763A682074152A9264F05BE7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072037, "uuid": "8b1e7c22-d208-47ec-83d0-55f6673f4dd2", "value": "384:b+I5hpgy5Kbyq1kkIEJZYnimq3GTCuAfJD0gPGJqCq16hymdGUop5hf:KEhpgy+z9Yimq3YFAlZPeqCls3UozF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072037, "uuid": "7e5b9653-8660-458c-b83c-a93f305dafa8", "value": 22176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072037, "uuid": "ccd8bda5-d809-4f3e-86ab-a55c7a33b875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072037, "uuid": "9eb909e0-c363-436c-9542-21741875538c", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a465093-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095062, "uuid": "647bfdac-121d-4cd1-a4a9-6f6e8376d1fb", "comment": "Malware payload (Mirai)", "value": "b18be1970152cbb3f302811daa79e99f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095062, "uuid": "5e84735c-0adb-4346-8ea6-c2f9670db568", "comment": "Malware payload (Mirai)", "value": "e8fa014196818d3551c0f9a495310d01f1a5d951a95d34f5e6fa8d3461d0b2bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095062, "uuid": "46a9b527-db88-455b-b673-bead2f21be5e", "comment": "Malware payload (Mirai)", "value": "6c7f982c6a1570f33a42a27c3e81bf13a8f86d9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095062, "uuid": "1ab97220-464d-4166-9727-0f8d314df296", "comment": "Malware payload (Mirai)", "value": "8f604c9adc9754081333a14740802788c58a056279d95bb03e85ed1941137dafbcf455f6cfbd392316d3df18f98457aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095062, "uuid": "76d3bc46-ba3f-4bff-85ee-b74afb6f5143", "value": "T170F2F151402E4DC6D1AF82751DEA3E0A8E6AD35B850497E4CF0C6E3295D6E68DC7C333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095062, "uuid": "b7378f0f-ead2-452e-a04d-d08627d9dbe8", "value": "768:vCkGi0D/4BfI7dZ20q5KiJ63Qcp9oMQcvXEru6ZSxU2QdnbcuyD7UHQRjW:vBGbyqMR5vJ6A4ozqB5Qdnouy8Hy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095062, "uuid": "b2469b3a-df81-48d3-a6d1-e57c48b77043", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095062, "uuid": "a12e6717-22f7-4fc0-8844-5421315d0c23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095062, "uuid": "df9ca922-d66a-46b8-9cda-ac064084e643", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e97ebe-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095053, "uuid": "48fda4d7-70c6-4db2-a610-75ab582674f7", "comment": "Malware payload (Mirai)", "value": "2d5376d8728c1dc1dbd7923a4cfc2fa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095053, "uuid": "fba5e76d-cd5a-4591-a414-3be3edee6f42", "comment": "Malware payload (Mirai)", "value": "e94666504b15ec4bd5842a790012ba81e7fbed2bd07ff7afc4faf1f8d4579829", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095053, "uuid": "6568dad9-2a94-497b-a838-e5e96893596a", "comment": "Malware payload (Mirai)", "value": "fcd245bf975304328a4a6861f247d7ad7d7525cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095053, "uuid": "1bdcd176-d141-4005-a53e-55210bc1118e", "comment": "Malware payload (Mirai)", "value": "4d2c80e887546d25c55cf3f74bc7db70360873bc3f003227ad6c062f655b06da3706b0b5fcbd26b3c1c49cd125dd0d43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095053, "uuid": "84798c9c-c93a-408c-86c6-d870dbe4e53a", "value": "T1DDF2E0A7D36ACFCDC3A9507919DFB90F0241528D4C08E363C9B4B42914B5B2C56BA7D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095053, "uuid": "b512296c-10b7-41b7-9605-c3c3df94d461", "value": "768:BW/zEpEYEgHE+Tc+oivhnXZAi1hIwwKSR2nbcuyD7UHQRjt:E4B1E+Tc0hXOinVSR2nouy8Hyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095053, "uuid": "deeaa381-406c-4ef1-8081-9202ba055e22", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095053, "uuid": "385d9841-a835-4995-b21b-1f5541686d69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095053, "uuid": "72ef8100-5455-4ee0-a79f-687932d4a599", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af059a91-b7fe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762096493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096493, "uuid": "f192ed99-c8f6-4438-8964-58556865af25", "comment": "Malware payload (Mirai)", "value": "7a774546ecd2b2739aac2ec2dabfbafe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096493, "uuid": "9344e789-e212-4c0b-8152-6d62490f332a", "comment": "Malware payload (Mirai)", "value": "e95efbfa36c0a1a50887e48b330d597d4436390292d4532875619eb359337a45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096493, "uuid": "4650cb90-dbb1-4d71-ad9f-1dec104452ce", "comment": "Malware payload (Mirai)", "value": "722a8039505f4e88444f59ce0bbc76e83912a95e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096493, "uuid": "059e188f-24aa-4f57-92f6-b4e0c1563afc", "comment": "Malware payload (Mirai)", "value": "09bb04fbe55ea2a2b6e18c375f9f0a15a2589b708f396a8f2c6358b5fc1b168a18c39fdf49e39a2a6aec838cbf3c39cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096493, "uuid": "19e9e828-1be2-43c0-be2c-ad91d31dbf9b", "value": "T175244A97B901DEBEF80FE77604D30B207631BB551A531A26B31BBDB66D362C4281AF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096493, "uuid": "536c50c4-8fea-40e7-b9f2-1313fad724b9", "value": "6144:v4sRQxFqcooYLEytGaCUjEo06P2s2ZnbfREv3oP:wc5BjEo06P2s2ZnbfREv3oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096493, "uuid": "afe12c0d-3f4e-4b22-8c21-7aa3225aab85", "value": 219492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096493, "uuid": "a81b3477-3753-4e68-9f3b-3b5c163baee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096493, "uuid": "d47fe767-3e34-4e40-b469-bcb3ac032afd", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701f9697-b7af-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762062457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762062457, "uuid": "2f72f0a8-a0f6-4f81-9068-054a00a466da", "comment": "Malware payload (Mirai)", "value": "d05f40b045038bb5528f5385be38cecb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762062457, "uuid": "cdfa125e-2459-4e05-881a-f9a9acf0052e", "comment": "Malware payload (Mirai)", "value": "ed72f6c0445571cb407f4742e49a6f9244a13bcb9741b9b9b12d552e3f27138d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762062457, "uuid": "316feb24-46e9-42a2-9724-a363db764ddc", "comment": "Malware payload (Mirai)", "value": "db63bf591a94d8378dea1f5481e9f9ec263e8d50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762062457, "uuid": "b1800e45-93ff-475c-aba3-bd64dd2a471d", "comment": "Malware payload (Mirai)", "value": "9089c3fa391f3e606749b8271f5508c4b005f02d91af13996b1fe220637f1d042e5882bf4271e72c2e09bf64c1330350", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762062457, "uuid": "d0b8c970-9de5-44fa-8c92-c5a630cb053d", "value": "T1F983C61E6E22CFEDFBA8963047B79E21935C33D626E1C781E25CD6005E6024D645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762062457, "uuid": "610e0390-b409-4fd2-aad8-ce3a1301a13c", "value": "1536:f+2eYrNYroRko7OlVGGHqKjqMeVFiHJOIylesWFqm2tfu:f+1ANAon6lVGGIAHElaKlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762062457, "uuid": "b5de71d5-5c69-45bd-bac5-995de89c8abe", "value": 88624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762062457, "uuid": "4616da56-b029-4c06-a2f2-8eacb32f4c64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762062457, "uuid": "89bd3087-3a6c-4be2-ac33-6b99b9ca800c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fa7fec-b80a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762101518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101518, "uuid": "580863cd-d8df-4575-b4d2-77febf4f4367", "comment": "Malware payload (Mirai)", "value": "0b50520c5f8228269f9952bde4acb3eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101518, "uuid": "78516689-4911-4129-a9b3-e0eaedefb794", "comment": "Malware payload (Mirai)", "value": "edfca18f0bd19e7a4e3f6fdb63e20728374f3e4e79986fefb8dee92e0fed28e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101518, "uuid": "563b8b3f-d784-44ef-a72c-3a7849d6df3b", "comment": "Malware payload (Mirai)", "value": "942ece6dcbcccf87e98364e7f3d18ccb9bde57b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762101518, "uuid": "57d14bc4-5a61-45c6-b688-50af1d5005bf", "comment": "Malware payload (Mirai)", "value": "4ae1e5a5bd6fbf28c5fdae8eae8007bcaf30eeb1bb85c7386eb13d2ca8521a044a252a91ade8385fbf3be629c539b7e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101518, "uuid": "5e51c763-789e-472c-8d79-abaffc8fd8ae", "value": "T166240B41B8414F53C5C22BBAB79F41993B3277A897DB3306EE14AFB43F4669E0D2A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101518, "uuid": "ea40d9de-df87-4425-87e7-274ec2dc3632", "value": "6144:9DS9Gamyh4WAnNTR7yE6bssqY06W2dvNtgfMfD/ZvP:9Duh4PnNNNsqY06W2dVtgfMfD/ZvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762101518, "uuid": "6cd39173-ebc5-4c87-b532-c11d93702220", "value": 215584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762101518, "uuid": "787f146a-1d14-4cc9-ac4a-c5b82fb6c9c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762101518, "uuid": "3796d25c-370a-4e45-aebe-108af9963d56", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4bfeb7-b80f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762103791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103791, "uuid": "4489ade3-2792-4766-8040-4ec63bec249d", "comment": "Malware payload (Mirai)", "value": "a100948c1146f028f9e92704ae6f76aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103791, "uuid": "cf205c3a-091b-4943-8972-99d7c242e1f5", "comment": "Malware payload (Mirai)", "value": "eea5c703ae89be4c75c92b003a36bd305654c8c7834caffc9ba1162a3caed54f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103791, "uuid": "a5756392-c630-422c-9e02-cfd5a971ba1a", "comment": "Malware payload (Mirai)", "value": "a94b6add2f7c2f75d70f153216e10c403f5c847c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103791, "uuid": "cbfd8930-35a9-44b8-9403-95a8e4786f83", "comment": "Malware payload (Mirai)", "value": "799535590f1e5460a6e15a82c56714407f69e1fa29ba39fcc0032b4cae9d1de1edfc56c06fef6eccb5906f28b11f0b13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103791, "uuid": "177d4889-a04a-4bf9-bffc-51294a4f9dda", "value": "T186431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103791, "uuid": "76794c9b-3b09-4c0e-b26a-b50133d65c50", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9Tl:/M99jmL8BZp9IFUoWKdYuvQ5CIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103791, "uuid": "7be04195-93d1-4561-b3e8-f1e355f568ac", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103791, "uuid": "e7434546-5904-4adb-bfe1-c71aafc67360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103791, "uuid": "43832d00-99b9-4129-aea9-156397dce306", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32456118-b7e7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762086405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086405, "uuid": "7e15c896-b609-43f5-9e07-6d349b3ac1d0", "comment": "Malware payload (Mirai)", "value": "8d8905331f7eb7f841414c009df4d592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086405, "uuid": "37520b4d-4623-4c08-9d88-100f7eefec95", "comment": "Malware payload (Mirai)", "value": "f0077c3465fd9c841c3d68297303bff6ef212fba2ca77fb15e8bd1a89d5a89d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086405, "uuid": "399cbb52-c138-44b8-8f3c-a7ed328f42df", "comment": "Malware payload (Mirai)", "value": "c5e51cbc8eae25e2dd6042a0812775e2e3c349ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762086405, "uuid": "a69b154b-5575-47ec-b1cf-037c9aaf84d7", "comment": "Malware payload (Mirai)", "value": "e1ddba03ee90f5dd4071a2ca47694a9c69038d423ac417fdbf6d5511121f749938f2dde093466cdbeb72217087c72115", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086405, "uuid": "5e68744f-988d-4821-850a-0e57bd9e0d62", "value": "T147E2E121A0180653DF7B4571E92BC6022B26CFFDB3FF22A731281A7E54C89DD95B89D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086405, "uuid": "61f0f502-8c5a-4545-b9e8-0cfa4716b9d6", "value": "768:QNTBxwJQe+JSxegbAs6pnYi/hXYjQ3hALjliPm/Np9TMqIuYs3Uozx:QNTBxa+JlgbYtXYU+iPM9TrIuNzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762086405, "uuid": "e21f8661-4d8d-45d2-9737-8cb678ec886e", "value": 31172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762086405, "uuid": "832965ba-d9ce-418f-9bf8-88d0bec6033f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762086405, "uuid": "e3c8ac03-23da-4fff-9be1-c1f844108bef", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133a073e-b7c6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762072180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072180, "uuid": "cc62a86a-f1c5-49fa-9e23-ec0c99cd6ef0", "comment": "Malware payload (Mirai)", "value": "d61ce978685e7511a68e6a4a2605d0d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072180, "uuid": "21cad872-de25-47d4-b365-89eea1764cb4", "comment": "Malware payload (Mirai)", "value": "f07974f08ab620d96792fc0c922af29e097a71497d6278f94c64baba6992adea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072180, "uuid": "b3e1334c-8a5b-4cf5-bb9d-96780af15a2d", "comment": "Malware payload (Mirai)", "value": "c8acef078338f50056a9a6d2dbf11bfa83cccf0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762072180, "uuid": "a697abe9-077e-4b6d-8fe9-c32615b58e98", "comment": "Malware payload (Mirai)", "value": "c8660e9acba329dc36ef80faccb020ff629e6cd86e26bf3afb4f6378761ce9b137f625b80295789b81db65d6821fe21b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072180, "uuid": "1fa24011-cdfe-45cb-90f5-acd5317acddb", "value": "T1AE82C0604051BCF6C5F0887A6E95CA82237B4BB4F1FF39BA25244368F6C735B8A78543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072180, "uuid": "7bf8971e-ed46-4f85-bb15-2a9a7588decc", "value": "384:yIHdDxi5VVG8HuvbAO/3mcnqRdhymdGUop5hXw0:nQzVbRfcnqRds3UozJw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762072180, "uuid": "0527139e-2339-4338-b6fd-0973e06a1f0c", "value": 18500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762072180, "uuid": "234c3b2b-0e9e-4d00-bb0c-658a9bebdf66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762072180, "uuid": "b461ead9-acfc-4ecb-aa83-7105bbaffa1b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918d995d-b7fd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762096014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096014, "uuid": "f3046313-375d-4e96-ad06-9bd20795b494", "comment": "Malware payload (Mirai)", "value": "8978c022d733441a77e83c3d220becc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096014, "uuid": "91075fb3-9dfa-42b3-8057-03492aae4cd6", "comment": "Malware payload (Mirai)", "value": "f10d4a8f506c6c986da2872bd9f58d18342f26bf0c148c8dd31c5aac81a36013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096014, "uuid": "ef7bc49f-8c5b-43eb-aba0-b1d7e1a4a70a", "comment": "Malware payload (Mirai)", "value": "215da756f76537eadfe6dcf1aac8353169325d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096014, "uuid": "aabbf75b-08bc-4453-bbec-f7e0cce22a30", "comment": "Malware payload (Mirai)", "value": "eb2d3d9e0c6d6fd414fe13a019a12f162ee16b9b0225149832997b8b99b1557cfdcdfbef20c908a95a8474d5a7629c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096014, "uuid": "81d853a9-6ef4-4101-8008-aa731bda459c", "value": "T10744D90A7F910FB7C89BCE3706EB1B1114CDE81727A62B367238E964B64A64E15D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096014, "uuid": "ce367e5c-fe09-494e-b9bf-eb443acb0bcc", "value": "6144:K2XXx3JvHmiKEj3x/veBU0AmmrPXC4PEy5IT6CF70dD5tZUWi:ciKEV/70AtrPy6Ey5IT6CF70dD5tZUWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096014, "uuid": "1de651fe-6172-45d1-a038-ec2eb6ff8ebf", "value": 260477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096014, "uuid": "9cb35546-1476-488d-8f8e-970faf3392ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096014, "uuid": "b4ef020f-8fbc-4309-befa-4a0c662ed74d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab169393-b800-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762097345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097345, "uuid": "34957415-285e-47d9-82ef-5edd3c3694fb", "comment": "Malware payload (Mirai)", "value": "b7b6e43958cefadc430ce739187b9e64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097345, "uuid": "488c40bf-dd6d-4beb-87a7-0756446006e8", "comment": "Malware payload (Mirai)", "value": "f23faa8df2853a4c980fffd924650ea3d89f1714b716685339f6ca52ed51a76c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097345, "uuid": "b1d987df-6ec3-4154-91e6-002534fe8190", "comment": "Malware payload (Mirai)", "value": "9c74c1585f84fd0af2e6722c24a7f141b8e45650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097345, "uuid": "39475849-d0c8-479f-9ce3-a868b4d9e3c2", "comment": "Malware payload (Mirai)", "value": "c69b8e30c27061118a695f175c45f22b6b5f08360b8320fd1dc8e21a04b689e938b14369dbf58d406bd51fa449d2d840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097345, "uuid": "5f67e945-3783-4782-a778-82dad5654285", "value": "T1DD63023CA4A0C2CBC939906448B182D3DFC74F8D37B51CC9B78F9BA0590B95BA9D4B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097345, "uuid": "7422279e-13fa-4812-b9ca-79f92119b947", "value": "1536:JNi1Y96Ix6M31o0J0tP8vKvVot7xDtK4u+qgw09hsiU0PXb/sl:JCE65IVJ0Z8vcCt7xDM4u+qgwGUKX7sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762097345, "uuid": "d3068032-65ca-46e8-b122-4a27c5d1a00b", "value": 67884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762097345, "uuid": "8bd02842-6937-422e-a8ff-6d3022256d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097345, "uuid": "bcd65861-f8e0-4128-8366-47032d810621", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11970912-b7ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762088498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088498, "uuid": "dd723781-14c2-4302-8d61-6f68c5ebb180", "comment": "Malware payload (Mirai)", "value": "b1ba9b2260abe0bd273a704c57a785f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088498, "uuid": "84886483-44c7-497f-9d56-a9a2b19d0955", "comment": "Malware payload (Mirai)", "value": "f291399afa165dc7f8e0c9b5d43d12c0c0e3b2d6937356eba3b450b7a5b851cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088498, "uuid": "8c1ad201-2e01-4893-a372-b201de56254b", "comment": "Malware payload (Mirai)", "value": "3fe3555a8c58b3d6d9d7dc8c076f50fcfe5eff67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762088498, "uuid": "d1bc8fc6-8f61-4ead-88d8-ac1200106a9a", "comment": "Malware payload (Mirai)", "value": "e026d0c5539b67a2d9ea4899f76933dcd9ec8be1406243d35c7a2111d53343082a37de736e3ec08e92374ee45af025f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088498, "uuid": "44e0b1fb-33fc-43ea-b2e5-9f782f85203b", "value": "T17DF2D0240514DDE1CFB31E3859590AA26AAE136CB0F93017268C9794FFFA0DC2F696C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088498, "uuid": "a953e48e-9907-4449-b180-9ac81c29bc76", "value": "768:0akLeT0Qdxeq42Oe88UkZ2DxKe9q3UELKU7:0aLxeq4TNkZ2lsLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762088498, "uuid": "5b892c71-d9a4-4ed9-bdab-16ee29be3ffc", "value": 35924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762088498, "uuid": "a7dc140f-68f7-4227-99b7-a8016ca14c71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762088498, "uuid": "0354beef-c834-4727-93d4-ed96afa2c746", "value": "SecuriteInfo.com.Linux.Siggen.9999.3816.2770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e483c6c8-b802-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762098301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098301, "uuid": "fa0c3fb5-0437-4cca-a86a-2c00d879cada", "comment": "Malware payload", "value": "c067032840b92220c390ec9458381c1d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098301, "uuid": "77184fd7-ec86-4963-9efc-c68e5606410e", "comment": "Malware payload", "value": "f42808ff4337bf6026e9524cd11dc4877f2492d442b37537e4191724bad63bd0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098301, "uuid": "f750c082-e0fb-48c8-9645-0d4522dfe6bc", "comment": "Malware payload", "value": "54ee497246c249e4f3ebf63305ac366b41de0a5a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762098301, "uuid": "72684407-ce8c-48da-910e-7e9393028bc5", "comment": "Malware payload", "value": "10fdd70d7a07cd45fb885e5eee3bb293cbdd1b09916f755fdfd9254c99f9b95ceb09a3d958ca7a6aad968ffd036d521f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098301, "uuid": "46d389ba-c39f-4d67-bbd4-ac387f4b492c", "value": "T148D512B38E5D96CB53324290F74FEEDCB2C29A19652990CE2B80B5C248D7B8D1B5F315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098301, "uuid": "ec85f5ef-95db-4f8e-be08-d7a641b9c45b", "value": "49152:sUSmiJ3J1Fv6/cgm/vzMj14vxPW+ZlHdVoNzqU82:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762098301, "uuid": "193ec53d-e603-4d13-bb16-8f91b8c36ee1", "value": 2976370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762098301, "uuid": "25ee7d22-e6ab-4150-8afa-53162d52085b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762098301, "uuid": "ade452e1-36b4-46d5-ad5d-237a70d0d2ea", "value": "877477.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6df4d3-b7ff-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762096781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096781, "uuid": "bd69880d-5140-44d2-8c94-93861cfd4399", "comment": "Malware payload", "value": "208445fc843b9e316e356be3cd90006b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096781, "uuid": "ba6ba900-5907-44b1-903a-bd989f4b500d", "comment": "Malware payload", "value": "f6263210de6f511a30930066bc6560d1e47c2537dfefb517ad8541212362b67f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096781, "uuid": "3f139d61-5b00-40bc-b999-5136deb0983d", "comment": "Malware payload", "value": "bc9fa16e347d855bc26e7cba2ab7ce3261b12a67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762096781, "uuid": "4717f6cb-53ed-463a-8c47-200e6e5eb58c", "comment": "Malware payload", "value": "a9c778e0ae1bae39df8f6f1b3db5ed339517fee583da8368494a2374c4cf8cba7a4e5f7f7e02e80e746fc9299a5eea77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hkdk-events", "colour": "#9D09CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096781, "uuid": "743c664f-769b-47ab-8cad-20bc511dda75", "value": "T123B58C03E69584EAD49EC078C7579632BB32BC8E0730B6EB1BD44A213E66F906F1D715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096781, "uuid": "c4c967b6-2643-4f93-b7f6-8f42ef4eb94e", "value": "928a1348fd22ec362e08a76d0569eb2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096781, "uuid": "026cbefb-59cf-4fab-96ef-d67e574117cc", "value": "49152:doShDFivfNcJImAIwXCepEDrErCDL2d6gM+cI4G1cILYIU6il4:dd2PXEo+jmn+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762096781, "uuid": "38d689fc-cf39-4fde-856b-d16cd35506b3", "value": 2487296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762096781, "uuid": "0b61cd21-5f89-497a-98a8-51a47df51ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762096781, "uuid": "e44561d0-dc37-4a10-bcf2-fcab99db87e9", "value": "lanudp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40f2fa9-b7f4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762092287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092287, "uuid": "bcfb36b3-67e6-4cab-8089-b315b71d47d3", "comment": "Malware payload (Mirai)", "value": "9d767cd6a4569be9e938091fe7e4907e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092287, "uuid": "c897e4a4-f9a6-47a8-acd8-e7c471514c46", "comment": "Malware payload (Mirai)", "value": "f6c31808368cc7dc32e5f751bf3a371132ed644c26fd1d8768dc50fe61163234", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092287, "uuid": "c1ea6489-0715-4b69-95e0-ef597fca9729", "comment": "Malware payload (Mirai)", "value": "ff65b94ff3e29bc8296e9a0c7d321b02f02aeaa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762092287, "uuid": "0c17c648-332f-4758-aa79-3846eb186672", "comment": "Malware payload (Mirai)", "value": "58b853210676934c3e75f53118b3aa3b83df415cec1a6fe9d58b583bf4efb0628a198c4610e7a16626c4a5a282fa25d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092287, "uuid": "fe5e4cc9-0bfb-4d2e-a4f3-6e83de409547", "value": "T1A0C3F796B891AF25C6D156BBFE5F018E33131BA8E3DE32039D185F6477CB94A0E3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092287, "uuid": "a5963d52-9104-4642-a27f-06a14a4efefd", "value": "3072:LMcK9EltVTNainNvPF73UpUjp185V8avI+tuvoov15nz9j:gbEltVTNainVF7kpUjfJERtuD119", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762092287, "uuid": "16d63350-2d4e-483a-9c75-e42dfe81209a", "value": 123824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762092287, "uuid": "cf011e81-8ba2-450e-9aa2-8e7c75e00292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762092287, "uuid": "ff3ff343-97bf-4293-84d1-5b085b5bbaf7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1543f6-b7dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762081967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081967, "uuid": "b9c0c2eb-cf87-43c4-ae7f-7fa6a1b6914c", "comment": "Malware payload (Mirai)", "value": "750118a03f9b6693dae4b9175fe6dccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081967, "uuid": "636d9876-8127-4fbd-93fb-51bf4d174b16", "comment": "Malware payload (Mirai)", "value": "f935c6158a5b5da6275ca5404cb012ea4c7cadd7714cdcac8fd54473d1968e49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081967, "uuid": "9e4615b9-c920-4a38-a10c-9bab7d3b66d6", "comment": "Malware payload (Mirai)", "value": "05b4d5dd9630a914ba58bc42244a4364de6abe8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762081967, "uuid": "a8bd9f7a-6c13-450a-9789-fa7b9d56e078", "comment": "Malware payload (Mirai)", "value": "0c0af4575e968920863cee4cf6fbf42bb6146e378a363d3f8f9afb2d1737ab339e83ac67d9e1f60676b6afda424de8b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081967, "uuid": "9d144c88-7465-4d91-98f0-85583685f3b1", "value": "T173732A227D360D27C5C1A87A62F34728F1F6538A26ECCA1E7D620D4EBF246403197AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081967, "uuid": "9212d9ea-b37e-4882-83aa-bcc933e09d00", "value": "1536:iT0jCJIdnIPiAbX1L2UIvqd+tdhnt5VcntuR5sOG:Y5+s3bIvXJn/JqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762081967, "uuid": "8878dfd0-a491-473a-be6a-ff4a41275591", "value": 75428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762081967, "uuid": "d813723d-e93a-4040-b5d7-2ce6f8c9aede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762081967, "uuid": "b783fd45-13e6-4878-babf-159ae2af42f5", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecce95f5-b7e3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762085000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085000, "uuid": "65016ddc-0727-4b07-93f1-77e5873e8396", "comment": "Malware payload (Mirai)", "value": "74bae59a3d0895a586b0025270a5fdf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085000, "uuid": "d2389952-fe2d-41e4-a8d5-2bdca0b19884", "comment": "Malware payload (Mirai)", "value": "fa061f97e5d65b54162b7a50797ae4b2bc5b1c5514b2cb6cea3d9e633716fc1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085000, "uuid": "e81e8489-43bb-4bed-a815-f4d4fb51b448", "comment": "Malware payload (Mirai)", "value": "55777f8a7375bf80842b1eb15cefb21125a61a9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762085000, "uuid": "1d0a1bb3-31fb-44be-aab5-febcbfd65c2c", "comment": "Malware payload (Mirai)", "value": "8682281f85215e6cf189aa7a5ea8c27eaf2d488014a7b00248ed11194a705e3260a9dc5ca8077d339f5aeec2f59868ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085000, "uuid": "aae6b724-2085-424b-bb67-e242b704bef2", "value": "T1F1538D33C125AA94E09455747431CFB56723A84482773FBA5AA6C6F5E08BEECF2093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085000, "uuid": "d9667503-8058-4e60-b665-03e9de10d3ef", "value": "1536:rab+CFScNqJXX5hbs52vKdvPu/uZC8Hw7Qo:redF+vG2ydsuZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762085000, "uuid": "2aa2961b-d977-4474-a2f8-5d20d5362def", "value": 62656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762085000, "uuid": "e2647c30-e9e2-4a43-8bf2-24b86eab4647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762085000, "uuid": "fd404380-15cd-4511-b55f-a1e6a9b08336", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e11948-b833-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762119192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119192, "uuid": "2c2dbebe-b102-49c1-ae43-952277bee96a", "comment": "Malware payload", "value": "e61cef85388532045b7e8d0e87cb533d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119192, "uuid": "d0bf4dff-7acf-474a-a1c2-52280f6ac114", "comment": "Malware payload", "value": "fb1f8a8eceb7955643f3d928f8af17e9c767326bd1ad8fbb97dbf520b2977dba", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119192, "uuid": "08cbbc15-3d53-4f10-9399-c7f6eb1566b8", "comment": "Malware payload", "value": "6caf0ec95ccea1f530130450314d90ac7da31135", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762119192, "uuid": "9b21fc6c-341e-4947-903b-26fe08f9d392", "comment": "Malware payload", "value": "fd47a142082dfc24deb8b08a41fde2c0b378e5a4b7abb4a708cf5270686c5c23909d3dc4025aaa7125194628278daec0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119192, "uuid": "f219e979-f58f-4926-93a4-279b6ffea034", "value": "T1CE71F70BB50F83154DB74A6489AB290DE56601936A344038FFDDCA1ADF70BAED2901EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119192, "uuid": "f3cf23a4-aa84-4e50-bf59-27867276a765", "value": "96:2/BXmtLR+VfZQ/fA1lsXm0/UhInA62Oa1gF:2/xmf/Ev0CrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762119192, "uuid": "41ec17ee-8756-438d-8277-d67c6bbab75f", "value": 3651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762119192, "uuid": "7243be2b-59d6-45a9-b90f-bd8a909ba5bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762119192, "uuid": "d120bd43-49b3-461a-9ebb-65f06c8a11e6", "value": "PURO - PROTECAO.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3213996-b824-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762112821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112821, "uuid": "2dbc7c00-e172-4107-b23e-ecd924c29b58", "comment": "Malware payload", "value": "dd08e68a7e2f5c23033126092d3aaaca", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "extra windows", "colour": "#707A62", "exportable": true, "hide_tag": false }, { "name": "ransom-worm", "colour": "#FD1F5E", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112821, "uuid": "0c353b50-d7ba-4521-9018-768bf62514ff", "comment": "Malware payload", "value": "fb250b64db8d56b0094ec19b5a79d8cce784be23f388525801daf6e1ac363ca5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "extra windows", "colour": "#707A62", "exportable": true, "hide_tag": false }, { "name": "ransom-worm", "colour": "#FD1F5E", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112821, "uuid": "2129bdfd-46f9-4a1b-9da8-4707d19389bc", "comment": "Malware payload", "value": "db162b76abf25abbb1d4d8b81218c091627197e1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "extra windows", "colour": "#707A62", "exportable": true, "hide_tag": false }, { "name": "ransom-worm", "colour": "#FD1F5E", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762112821, "uuid": "5300c789-b93f-485b-b749-bd8164bebc9e", "comment": "Malware payload", "value": "424d59cdbe5ff7e5877c4c7856d2d8bc1a98b2532c7e4ff74a04e11b9179c53a6f12fa08fe9917a7fb806339176f5278", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "extra windows", "colour": "#707A62", "exportable": true, "hide_tag": false }, { "name": "ransom-worm", "colour": "#FD1F5E", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112821, "uuid": "2ed9c053-652b-4799-95ce-3411f27f59af", "value": "T11EC2B81B1A5A802688D7D3B2C89BC592EF3451882441054B33DCD0F7971F1AEFB6BF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112821, "uuid": "783f5630-5dd9-486b-b264-2107ff0913b9", "value": "384:dSpHfXdTwhq3nwfP5zCpiOSzdgA6VguA6VguFolRdBFolRn+73nw0PPYCogJdj8p:dSpHfXdTwhCivzd3/QFpNe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762112821, "uuid": "5338ab42-6d9c-4a87-9d18-e49d320cee4c", "value": 26426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762112821, "uuid": "0bd6cce0-695d-48d2-82ab-852a99bc3274", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762112821, "uuid": "3b476753-8820-471a-b5b9-97e264a30a24", "value": "Updater.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8766737-b801-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762097851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097851, "uuid": "a9b4f569-5af0-42b4-a5d4-dd883c9876eb", "comment": "Malware payload", "value": "7451146c34da072dbb6ff52e7b315a8a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ransom-worm", "colour": "#FD1F5E", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097851, "uuid": "89d351af-d9d6-40ad-9148-096283f06e48", "comment": "Malware payload", "value": "fc95b68496dd9b1142963372ed5d9fb2c90ee469ca4bc99c48cf86a021b8f9b7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ransom-worm", "colour": "#FD1F5E", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097851, "uuid": "c9d4bed7-7e2d-4059-bc99-903a0600666d", "comment": "Malware payload", "value": "142039bce9cab4e43c4be39754e8d926e4193088", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ransom-worm", "colour": "#FD1F5E", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762097851, "uuid": "7cb305d3-bf6b-48b1-bf44-fb40573bca5e", "comment": "Malware payload", "value": "026eba0d63336f66ff9474c31e6ee36f5b004d8f844f15c9953b568565369a910a7bae5da3f2807085d7b621691f3f62", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ransom-worm", "colour": "#FD1F5E", "exportable": true, "hide_tag": false }, { "name": "Updater", "colour": "#6D5626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097851, "uuid": "3c978c5a-fed8-40b3-94f2-ce4a78c587a3", "value": "T120B2A81B1B5A842688D7D2B2C85BC582EF3451882441044B33DCD1F7A71F5AEEB6BF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097851, "uuid": "6d2d5680-a6d0-4805-a05a-9c7634085e86", "value": "384:dSpHfXdTwhq3nwfP5zCpiOSzdgA6VguA6VguFolRdBFolRn+73nw0PgYCogJdj8c:dSpHfXdTwhCivzd6/QFjNR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762097851, "uuid": "9333510b-74d1-4549-ae65-c1eb915b1ddf", "value": 25412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762097851, "uuid": "c8c131d6-bd20-4959-aec5-dc8299c7e979", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762097851, "uuid": "7c61854a-1dc3-4675-bc15-0b9b1f4bcaaf", "value": "Updater.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d86dbf9-b817-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762107147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107147, "uuid": "f9f7ef1c-2f00-432d-a14a-d5987d4e655b", "comment": "Malware payload", "value": "2460ea06924ef808adec1ef28e484301", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107147, "uuid": "70d65cf8-71f8-46c5-91f8-3c312014596e", "comment": "Malware payload", "value": "fcf7ad5c421a0ab7c58a0adc7230e5607ceb214084539e0ebb4208371a496561", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107147, "uuid": "1b400474-039e-4063-bc3f-5faade7af8a8", "comment": "Malware payload", "value": "2bbe5fcbb7f2ca8865fbfaa85ee60c99f0ca1b16", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762107147, "uuid": "06254561-6036-42f9-ada1-9f568bd5b669", "comment": "Malware payload", "value": "5525e708a0eac4476e258db8c7ec4b9acaf740f31febbed41514cf6dda53e2ceb66ab16897fc3c7c2a5ead1803492687", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107147, "uuid": "65818259-5c79-4c54-9ced-da8a659d69ef", "value": "T1720175ECA4B2F787171EDF08F067C26D905190D2A3F0CE55E4990E35ACD8E01231936A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107147, "uuid": "6795d9ff-dd40-4de1-9a40-247dc02a59a7", "value": "12:3J3elpeS4QeKNIl51e30LKySD+OtSUJXSo+2STp2STpfippM8yS:3J3KbNI7xKbD+NUJioxwQwZiDV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762107147, "uuid": "2e9293c6-1018-4c9d-ac23-f7bf77bff496", "value": 708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762107147, "uuid": "e4b315d4-c29c-4b4a-b3aa-f76631ef34c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762107147, "uuid": "2eb86599-a688-41e0-bbd9-bfdd0633046c", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f7b014-b7fb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762095293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095293, "uuid": "23bc2ba0-68cc-4ef9-8a53-ae6e844f98c3", "comment": "Malware payload (Mirai)", "value": "e41f32c5e29fc327802f095ee9af579d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095293, "uuid": "c84aa7eb-e7ac-4090-8c92-e86fab5e53b5", "comment": "Malware payload (Mirai)", "value": "fe703eea58b8c8772b004f72c439f7bbc2275de6f70b0583d02cbd8a5b1aff52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095293, "uuid": "0b818614-0a33-497b-9538-b62c9949a724", "comment": "Malware payload (Mirai)", "value": "1cdd8707799c2500e397ba315652b7bcafc422d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762095293, "uuid": "7baefdeb-7fd0-42ae-b369-d3b1e5a74fd4", "comment": "Malware payload (Mirai)", "value": "d942044fa27a04dd9439298713775181a5e0a96f2884558f0b2811821de8e6b900582c2e5f31dbc47190e5897ac1b075", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095293, "uuid": "698e9e34-d011-4d66-8e1c-b518fa65ef11", "value": "T1DDB31986BC81AA11C7D25A7BFF0F428D331657ACE3EA3253CD185F6436CB55A0E3A152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095293, "uuid": "f603e455-83d7-4667-b220-122a83e7e56f", "value": "3072:b8w0t8BKZJd3sWtlB3+cTNKwFNw8aLFMf4viUtA9hoFAQ8/hnIwBcaAnzJ:Iws8BKZJd3PtlB3bTA+K8aLFnviSu5jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762095293, "uuid": "41107b59-f7fc-441f-a90d-c3de82f73407", "value": 112664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762095293, "uuid": "adcc06e2-4355-49c5-b95b-1d3ffc1a2845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762095293, "uuid": "11270eb0-0b3c-4d7b-bcf9-51d420563cfe", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12bff15-b812-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1762105167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762105167, "uuid": "2fc9ee5d-668f-4bd4-96f5-a5186beeaadc", "comment": "Malware payload (Adware.Generic)", "value": "9485401c016a2305d1c5a0cf7a118af7", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762105167, "uuid": "3141f550-62c2-4f1e-81e7-5c2a44f4e4d5", "comment": "Malware payload (Adware.Generic)", "value": "fe75132f4f4c44735bdc3d7572e5768a22f924f7541ece40c340835a461fb7ec", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762105167, "uuid": "8236694b-6e20-4cb3-9154-69a460a516e2", "comment": "Malware payload (Adware.Generic)", "value": "734721104b4b3eec8a83040ae28e9ed77dd1e387", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762105167, "uuid": "3236df61-dd30-4b46-896a-691176405e6a", "comment": "Malware payload (Adware.Generic)", "value": "0c7de341cda7528b70fdbc74909621d3e2b871a0e32d2858c7472f82451593516f5b00a8d46f029b5d73ab2c4a46e660", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762105167, "uuid": "51d8734a-efc0-4426-9044-2637a5ba07f5", "value": "T1ED652351FFE18875EA1E0133C6A07BE1EE74ED640E11448F27807A1D6E3D78ACE2E695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762105167, "uuid": "e952a8e2-8dd5-4dc7-90f5-296250e36e8b", "value": "e00de6e48b9b06aceb12a81e7bf494c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762105167, "uuid": "412cede9-d532-40e8-a0e2-3daae0fb8211", "value": "24576:kG50ZfFK8SgNXQ1g5JruMCapWPTFHic3C5901dF9eTVB5qFkWh+wnc1+:kG5UfgE5XWapKTX3Cj0LFqVBAfhLc1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762105167, "uuid": "68dc324b-8a99-4e65-abb7-c739194b870d", "value": 1490416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762105167, "uuid": "e1e33eb2-12e1-48c1-9fab-8741a66d0471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762105167, "uuid": "cb7e95aa-f86b-4285-a187-9b9b0afe7155", "value": "RP16N0X.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb33d46-b7a9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762059878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059878, "uuid": "669c1579-7c0b-4be3-b4ff-7ebc77fa62d8", "comment": "Malware payload (Mirai)", "value": "520d58b1ddabbe0523288d5c2a8a1824", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059878, "uuid": "8c426e12-29c1-47c6-96bc-be939710d25e", "comment": "Malware payload (Mirai)", "value": "fed94af76ec1c85b41e9f82543e793965bf2ebc0d82ec8d371a0016293b163da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059878, "uuid": "f2ed9d5f-0997-4090-b7bb-773a5b433a69", "comment": "Malware payload (Mirai)", "value": "8cd6931a78bb03fc35a86f39ce370fd79e134cc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762059878, "uuid": "445d570c-d82d-4e25-9af1-4a43c9641910", "comment": "Malware payload (Mirai)", "value": "d1782772b7a2a6de9c9c29debb1ddd5d65b1ad451902a2f29d068b983aa4345aa046db89539265d84d84a6c64ef44623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059878, "uuid": "9c1a084b-856a-42cc-a92f-a7ad30c8ed29", "value": "T13D6329A1BD816A22C2E12377FB6E418E371553ACD2DF7207CD22AF2037C695B0E67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059878, "uuid": "5011404f-8a1f-4523-8e14-e4dce8261bcb", "value": "1536:1K0G591WXJ1+i2a3YoeflPDqVUC284Y6vHCMyRx1sOgbzgEBW2Qv+SH:1Kl31CJwi2YYPDDC2z/CMqYEvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762059878, "uuid": "ab4b6f0d-02bb-4950-a49a-4176313a53a3", "value": 72748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762059878, "uuid": "db952398-6f38-4289-a0f3-909398570230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762059878, "uuid": "6557b9cf-4e78-44eb-a8d8-fc4cfce04ce8", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f847ee84-b80e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762103488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103488, "uuid": "97fdb096-0432-4bfa-84f9-4f599bb135e2", "comment": "Malware payload", "value": "4766560bf928a75006d37d60973898ca", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103488, "uuid": "e0552725-13dc-46ea-951a-46a32337bfa3", "comment": "Malware payload", "value": "ff2dc7d90d6da16ea6d0692faa911017a60ea67935e9235bf06a43c0f1e89951", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103488, "uuid": "f21e7e6b-c3b5-4fbc-a9d7-b874dd23ffec", "comment": "Malware payload", "value": "277b9d0163473e6abe1275fbd99e48a7a9ca819b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762103488, "uuid": "7687a49f-26ee-4554-97b2-0b33485d4f06", "comment": "Malware payload", "value": "496c1485fb195abee3f6d180a51ade9e91d6b27715c674b6d167f31fda576c651e9e844cd710461deba89eed57654699", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103488, "uuid": "0c999982-5b57-4e02-b0bd-ac5e29d04f15", "value": "T1CDE5227066E60B44F1F6573DADB62B808876BE08DA22C78D011491080C30F25ED2577B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103488, "uuid": "2d164732-a1aa-4cdd-91c4-f56637043183", "value": "24:8d/A+Orvlf7OrfaiAK1lTWgYJKEPFyzP8BWK8rbdNZ:8lAHZf6bjnmKEPS8BGrbdNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762103488, "uuid": "2444ee83-e6c7-4bf9-a09a-380b4db81654", "value": 3144638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762103488, "uuid": "081bab9c-bf47-4166-822b-37d2e461b6ee", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762103488, "uuid": "2e47fb33-5501-4657-b5e3-f476202b7a43", "value": "dodatok2.ppt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }