{ "Event": { "published": true, "date": "2025-12-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-06", "timestamp": 1765065781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c81d6985-4f27-416a-a5d1-7fca6d80b11d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2632dfc-d247-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764986582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986582, "uuid": "228b35e1-536d-47ba-b80a-27dc9867035d", "comment": "Malware payload", "value": "a8fb4d842b0fa7576c4715091151ae96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986582, "uuid": "3d89cfbd-100c-4299-8bc5-2c3a4a0b4205", "comment": "Malware payload", "value": "00047796d0f5d80f78be0decddd9ebd31512516cc0be6256d733efc675894c2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986582, "uuid": "ebe99c88-e906-43d8-8771-be5949b76acc", "comment": "Malware payload", "value": "6188d978439216b4cda5eb6e2efa826cc2e4ed5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986582, "uuid": "705f7bf7-3155-4d8f-89ba-d21f2928c1b9", "comment": "Malware payload", "value": "38b4bcd7e1775824e17524b73825a2b8115731bd9cb8c6a3acd59e494ed7c569e06154deb2fd526796213f1df827f6ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986582, "uuid": "8e591cd6-82a4-42f2-9d75-6aca1e4c5799", "value": "T120E12382BDD6CE3BCCA9637A1673C6203372C551AB439B17210C48753D83AEC6D76B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986582, "uuid": "bba1af80-b668-4da6-a088-2a57a9ef3143", "value": "96:8xJFWLccScsKLmg/vdpklpqxMYc3O9Ff721a5BI31HBgVcgOu8+TiImDW:tccSvvg/F+QGO9FfN+1H6VcggDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764986582, "uuid": "eaee01a0-ac27-4384-9b67-d0f9683562d5", "value": 7316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764986582, "uuid": "19f82015-7ea5-4019-ac37-c94b09938594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986582, "uuid": "04d4b18d-b27c-49e7-b37c-55d02adc1b87", "value": "linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7947eae2-d2fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765063366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063366, "uuid": "1c06341f-e474-4987-a6d8-7d6e5747ba86", "comment": "Malware payload (Mirai)", "value": "b5e0e4c4fd4a8bc5585d5dd08ab9b36c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063366, "uuid": "b5a3964b-ee4b-4555-a9ef-00e923e4bbc4", "comment": "Malware payload (Mirai)", "value": "0034bbc1e465614894f4284f6bb920b3231efc16856e26b6a8316e99a682526a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063366, "uuid": "8d10dcde-6944-40f6-b257-f0faab6788a9", "comment": "Malware payload (Mirai)", "value": "9e7a3592c77a2b74677441f8d281e284b7c239f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063366, "uuid": "ec20f891-bbc2-49cd-99a7-4f26e3cc7ab8", "comment": "Malware payload (Mirai)", "value": "1043796186e8f436ea6686cb6b92178b0eb527e1e213bc6b9bd536f8401e874a5345f6bb44bf5a9ecacc3783b2e58ea0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063366, "uuid": "41bf901f-4e4a-4cd3-a263-c97ba133d52b", "value": "T1ED43AE72C82A6D58C1588A74B5344F352B63F058938B2FFB0A9AC6695083DDCF6553FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063366, "uuid": "afb78feb-2bca-424e-8781-22f95ff9c145", "value": "1536:yraQYPHfJqNR3BMMdl0n8mpKiR3C7hRR2qCgFDzZT:UrYXcNR3uHn8mQi0TR2qdZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765063366, "uuid": "53abd669-6a3e-45f5-88b7-e74d240777fe", "value": 58684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765063366, "uuid": "ee4026e4-003b-41f9-9e70-3570d2067877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063366, "uuid": "1961222f-4db6-4535-950e-d48f56525b15", "value": "fent.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862f3043-d29c-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1765023015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023015, "uuid": "8b207e4b-f0e9-40ad-89d1-1d08f28a3eed", "comment": "Malware payload (GuLoader)", "value": "6b00257ce5a88d4af0e8ad56f6c0aac8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023015, "uuid": "679fd85a-adef-48cf-ad59-1cbf0b1efc45", "comment": "Malware payload (GuLoader)", "value": "010ecc31c0e6144bd4efcd7100d85584decf6d3d286f8e20f6ba01775be02911", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023015, "uuid": "41470fe4-1536-492e-aa04-63d56bafa49d", "comment": "Malware payload (GuLoader)", "value": "b2028b178ac1085f625263a12e3d979a72b1c78d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023015, "uuid": "83ff19b1-7240-438c-9908-33db38d29217", "comment": "Malware payload (GuLoader)", "value": "2c7689576738ae0e9346bce935e8fcef60036a25c4bd1efcc46c82f40705d0153436b238784c7249973e958e7e2222fb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023015, "uuid": "b45e8b64-33bd-48f1-90ec-4ac615e367d2", "value": "T1E6055B20DE68176D4E431BADFCA4036189ECC609513695F5FADA034EA1068FCE3BE779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023015, "uuid": "79e7aff3-4754-42fb-8e4d-9c48f4a93cdf", "value": "24576:3/EO/E7/pv/Y/E/Et/C/Er/w/o/s/EC/EB/E5/g/Es/EI/U/q/EI/Y/E6/ER/EmA:3N+xvwcA6CIAEXQEIXJMiPARW5GNPnNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765023015, "uuid": "9238bdc8-1cdc-4f81-a575-524dc298a103", "value": 873657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765023015, "uuid": "4db9a035-cd22-49c3-be67-f3b0ed818242", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023015, "uuid": "9b592ab0-1a78-4b21-bcdd-d033b926c6f9", "value": "Bestellung 2621064552.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2290fa-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049624, "uuid": "bd9fdae8-f276-4347-87dc-63ad32a0239c", "comment": "Malware payload (Mirai)", "value": "da5c92ac110b3234b663924f7bfafd3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049624, "uuid": "609350a9-0ded-46b3-abf0-6cee9d58b539", "comment": "Malware payload (Mirai)", "value": "014d7e3eabbbb90a62d9a7a74553ad7a854683818acddd0e13a7072ed5f98fe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049624, "uuid": "36e18176-6fb1-4a34-8a9e-bbe26b2c804a", "comment": "Malware payload (Mirai)", "value": "23483a2ecb36534e0e735a47e1efff013c5a01c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049624, "uuid": "d4b33869-36a9-488a-90eb-34f6a9bfb821", "comment": "Malware payload (Mirai)", "value": "ed65bc4d110b70df2ac821fe595ef7a45a944119b8a545f52659fd1971d06b03cba0aeb38ac09efff4d30f5ba2d3a0b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049624, "uuid": "24abedcd-d625-4b08-9f52-af962d4d4a7c", "value": "T143155B237711DF69E354C63009F3C66156E621A21BE2508AB278C32C7EA162D6D5FEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049624, "uuid": "df56ad7b-1ed8-4874-84b7-6849ba9e22e7", "value": "12288:kQ47bYtEgYPrS/P/7eyqDucnhhyRaLV8R+RAP2iLkNVxS8pfKQBOmrv8VOYR:P47bYtEgurVnhoR2V8HP5LkNVsg70VOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049624, "uuid": "62f4566a-4f11-40fd-b071-78bbd62dc791", "value": 891420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049624, "uuid": "ec9e4ce4-6f52-4ebf-87d5-5e62c13ba883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049624, "uuid": "02ea78ee-32e8-4f6f-bae5-26de408a9b47", "value": "mips.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2125f85e-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043461, "uuid": "71e9663a-da4f-4c5e-9fdb-74704701c0b5", "comment": "Malware payload (Mirai)", "value": "d779969993b636b9025dfd2dde445be4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043461, "uuid": "0248f631-a368-4f76-8e5c-c41949ae6e90", "comment": "Malware payload (Mirai)", "value": "0159cc82783133fadba23d723a60a147c3ad0a66330990c703bddd8ae624f0d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043461, "uuid": "e9bef484-c8f0-4d31-913b-0e25d89b1439", "comment": "Malware payload (Mirai)", "value": "014c825069fc4992c968240e9a0fc3b76df7e29a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043461, "uuid": "c4a1c116-54bd-471b-90a6-1cd5c0451a08", "comment": "Malware payload (Mirai)", "value": "7937792794f40a79607abb9ea4aa9caf930de1548e79f5342c72b8f94eac0b702ff8be68fe23c80bc32858e9e0a70900", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043461, "uuid": "27cd419f-6805-46a0-9652-5d59b23be069", "value": "T124F2E07B75D8FDE2C9A382B890948F407A935F36E093346C35184399F9C962F01BA9D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043461, "uuid": "39aed6bb-9d5d-4162-9cb5-843d035543aa", "value": "768:M8kUDTbWxEjCV5PEHHeDgk1V2OpmtqnZxtkAeePAtm7j4L2hs3UozE:M8kUDfIE25PEkV1FItCtkbePJE5zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043461, "uuid": "8221c6a4-5b6f-4492-80d0-cd57fd60531c", "value": 34628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043461, "uuid": "768b0712-9b6d-49f3-a107-3df39fc75d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043461, "uuid": "145e91d4-788c-4b23-8d60-ee00957128c6", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361b9392-d2a0-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765024599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024599, "uuid": "c6cafbc2-efa1-4dd0-b0b9-0049428385d6", "comment": "Malware payload (CoinMiner)", "value": "e63e105f9a7920b4b40a6642c7995b7c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024599, "uuid": "9357787b-ead3-40fa-a946-ad8acfb1f786", "comment": "Malware payload (CoinMiner)", "value": "0317ad351734e54f5a4e8db0444662d7a34553d1cb25bffa877217d254ca23ed", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024599, "uuid": "e3f70d5e-c34d-41f9-a41d-a733fc090a34", "comment": "Malware payload (CoinMiner)", "value": "50855041fe009f2ce545347443ba33cfb19f2758", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024599, "uuid": "5a6d6242-ff83-41d6-9278-dd1abb370f0f", "comment": "Malware payload (CoinMiner)", "value": "7c75416d140b295c0cf69865d38757b6048cf90c9c0596fb435792a62f884520755defaeba66a6395d6ddbd9fd42ccef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024599, "uuid": "001e2d4e-ae94-4f90-afbe-4f7cd5711079", "value": "T1BBA14412A494AAF47D4F00394FBB31103934618B1F45BE6870FDA0665FBC78653B776A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024599, "uuid": "d353b943-daeb-4e74-a85e-35573f68b88d", "value": "96:N5YoZnBXPQQDUSHUStVhzp1t8SN+xEDB9Xt8SdQpKtH:N5YslMSRpthvnXthgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765024599, "uuid": "a8ecdd10-7470-401b-b74c-ae1d903d6eaf", "value": 5012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765024599, "uuid": "560c5a0e-775e-459d-ad2d-a3999cfe4e66", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024599, "uuid": "6675cd39-8b3e-44f5-bb3f-5731a9f8f93e", "value": "sex.sh.2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4755a662-d29d-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765023339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023339, "uuid": "447527f6-52ab-43a7-9a47-dd59462c7750", "comment": "Malware payload (AgentTesla)", "value": "e581f8d4a9ed4f44c854580cbca3487c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023339, "uuid": "bfb90cb7-1fb0-43c4-8bde-1bb3ef1543a0", "comment": "Malware payload (AgentTesla)", "value": "03aba2abe4723b5ba3ff21911703ee0349e5e1f1b76d964284981d913958f97d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023339, "uuid": "50e6efb7-442c-4107-b6ef-6efcb3a0d85b", "comment": "Malware payload (AgentTesla)", "value": "bdcb90dce7ec1204c55b69f0e3adc3cb06d6b80e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023339, "uuid": "a92dee24-2ca3-42ff-9bd1-6b9de8b78ee6", "comment": "Malware payload (AgentTesla)", "value": "1a450ba09fe2ef41396f430ecbd160968b387d2ebbfa75cb141cc45815875fe2897737c0953155eb62534e5f8786f15c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023339, "uuid": "e0db824f-7e7a-4d68-92b3-12858f40d450", "value": "T1A843F1860DFFA39D02E549C4E0AF6836BF94706FFC56DF6598FB5483CA1A894425B088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023339, "uuid": "cad9b3c1-b29d-4283-8f9a-612869875783", "value": "768:xilGcJ+eVWH8yHd0QNE6qKUUQ0avhddeLSLrwd5nSTdfaz+249WtYTk6la:YlGcJ+dcwdgHn7e+Lr9do+x9W6I6la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765023339, "uuid": "48d9d670-10bc-4db6-ab1f-2943d70c2db0", "value": 55548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765023339, "uuid": "930c32e7-65af-4098-8226-e6b21a1f26da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023339, "uuid": "cff524ba-2159-4710-9b72-e89bb420c678", "value": "RFQ - UID01553.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503d8cad-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042252, "uuid": "54fe4068-a187-46e4-a359-457386a0b734", "comment": "Malware payload (RustyStealer)", "value": "578dc45d359a94e03e3ec1b9e5a9bbae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042252, "uuid": "2b671b7a-68f8-4911-b18a-4ae98045c232", "comment": "Malware payload (RustyStealer)", "value": "044a686198878ae1dc4f061c66d0917c7fc2611afe94a1b200b59f4a667aba82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042252, "uuid": "d380aad6-d516-42d1-8f7c-ef257b09b341", "comment": "Malware payload (RustyStealer)", "value": "bc0c3fa2a2938fddd40d08acbe1c2d0c2db0154d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042252, "uuid": "6613f20e-1e2e-4508-9187-952eed641dd7", "comment": "Malware payload (RustyStealer)", "value": "094e417ac2b9886e74f7a1e0cb1a7ada71eb4e216a4ed897d26f34cae4385f32449a81cca42249703b878e12e611dea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042252, "uuid": "b0860640-c1c2-4e88-9912-117cfba2fa77", "value": "T125A56D03F3A581A9C1DEC1B98705A775BD7BB88D096076BF0AD34A303E69E944F1E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042252, "uuid": "3e9f62cb-b679-4762-abec-d78c8769d896", "value": "5aff6c59906e71ba7f18f6b50812a6ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042252, "uuid": "be7c95cf-e079-4653-b0c3-88f2cbb94cd1", "value": "49152:5GjP0ydCl6/xSe7J88HxzA+8kgMWRJO58Eg:5GjPrJ88H9Wjgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042252, "uuid": "898d6989-d167-472b-915a-e5fdff192bd3", "value": 2129408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042252, "uuid": "29b95852-ce60-4975-95e2-4748361a305f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042252, "uuid": "83091228-2f95-4073-a750-81f8fcd44ffd", "value": "panel_dec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b6540a-d28e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765016834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016834, "uuid": "0a3682cc-a9cc-4b00-8075-780a27b6da62", "comment": "Malware payload (Mirai)", "value": "1bdf4c4ce0fbe15f17aa5e3a6105fe20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016834, "uuid": "c57a7398-b30b-48ed-bc97-6822361b41f6", "comment": "Malware payload (Mirai)", "value": "04527947c92a2df86e59aac8375b3ac545b2abfb69158eb07cf27ab260342563", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016834, "uuid": "11a8cda5-c17c-4580-8d76-ab36415d4fb2", "comment": "Malware payload (Mirai)", "value": "ebf2ea940976599777964c592c35228f045d3797", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016834, "uuid": "50d9e4df-02eb-40b3-b2c8-c4cabc39eeaf", "comment": "Malware payload (Mirai)", "value": "392cafd959b5e09bebca03f84bb52e8ae3a6f4bf7c430b34df06826cd0cf8eb9b12ec6dad0b375c7fb6dbce9fbc5a967", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016834, "uuid": "af190456-577c-4e4f-80fd-d966159e7f4b", "value": "T150A39E22F42A6C98C2540578B5E4CF351B23E0C45A139FF756EECAA7A087DD9F405BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016834, "uuid": "d8ce7b39-c880-4753-b869-d3e4d62395c2", "value": "1536:1/XZNpTGzZx7uzJ9vGsF00JTeXPneuKsU9nD757usg1C/xQN9MAfodH9t9y:1hNpqFxCWQxiXPneBsoDxuswD/1ods", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765016834, "uuid": "85b58468-6dcf-4b04-ae71-2b6756c9ffdd", "value": 100704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765016834, "uuid": "d758b7ca-cc9e-4410-a894-88cae341ac2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016834, "uuid": "9f3e9d3a-b2c1-46b0-9779-0de5815352a0", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fd825c-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006125, "uuid": "abddaa77-0e58-46b5-a833-2f1e52a45f73", "comment": "Malware payload (Mirai)", "value": "990db44e59cb551c8db0636902d7194e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006125, "uuid": "ff3e6642-1730-4955-8a95-addf46fcc681", "comment": "Malware payload (Mirai)", "value": "057ac3a7ee90a5453770791705cb5f9c509eb42082f3dc8d802aaf4e7b6de906", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006125, "uuid": "97959fd3-3e6a-419a-8fa0-fdc4dfb1f1c7", "comment": "Malware payload (Mirai)", "value": "3959bf736141ff38b5dc6fcbd128af6ca5700f93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006125, "uuid": "908d92a9-cf18-493a-b2bb-409a1b1bf9fe", "comment": "Malware payload (Mirai)", "value": "ba24170e781669557ad05c2d9cccb952616bcf88e995231555f658b3e442ef35705e35c2642d5b6841438409e88d0b84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006125, "uuid": "4f2b0358-090e-4511-9747-353ac4ada803", "value": "T1133110576186F8B3E222007759956F1B6B748CE26072FF0ACF506C11FC395C0D132364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006125, "uuid": "16ccbe98-d271-43dc-ac06-b760b801e635", "value": "24:FlJqmTk0ee7FAzhlKZFViZOC8VidFGZ8/Y/C/+1uNlzxSkySuluoFRVa2fNPr:fJKG+LcFVkOC8oFPY/k+1AzxSZSu0gRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006125, "uuid": "e1380e9a-d7d6-4300-851f-559df4c52599", "value": 1444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006125, "uuid": "1ededa9a-68ed-40b4-a31f-59a3273a23ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006125, "uuid": "5033f25b-dbf9-4903-824c-5d920878e3ae", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f587151f-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038664, "uuid": "5024edd6-6b24-424b-b2bf-edc25bb7bb29", "comment": "Malware payload (Mirai)", "value": "b16c6c1279634bdab69cae868cfd8e32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038664, "uuid": "660a30f2-8622-4646-ad58-21c985106a6a", "comment": "Malware payload (Mirai)", "value": "05b17608e7bd1e4f1a27389f07783e31d3edb60180fa7937f175ba0e86707e0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038664, "uuid": "e5d0b30f-9587-493f-862f-d85a69f772e3", "comment": "Malware payload (Mirai)", "value": "d83415d82caf3bfa8fe40ae34c6a2e3c41bb6c6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038664, "uuid": "a7f00375-4beb-4956-b5c9-f2dfa85e27e6", "comment": "Malware payload (Mirai)", "value": "48b81ff7aa6ca064ab307f283b7fc78ffe1331dd6467cc338533ad0201d91ac22cec3aee8914d7fa51b0700a813383a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038664, "uuid": "042ea52b-779a-4dfc-83b1-d9a5a9253791", "value": "T1BC31217BF7FFBA07C8A485790C575B607263DD5C0024815A7940A51E5C91231BE623F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038664, "uuid": "a769670f-2053-4900-8968-2e5ed6757d1a", "value": "24:3CftLItNirb4Ry/2mLvEMu/NQKvfOxfxPCNIGFVEw15jC:ScirAq7sMmNV3fIGEcjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038664, "uuid": "a761e9de-8d31-42f4-8ab5-3e8b47d49afc", "value": 1472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038664, "uuid": "3f5cfb9f-abff-4e43-b786-95e5f8201975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038664, "uuid": "a488f570-f3fa-4aea-9fba-a3ec192a1793", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b72860a-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002408, "uuid": "054b5e26-05dd-4dd3-9b42-5a2560514589", "comment": "Malware payload (Mirai)", "value": "0c10242a8f14e0ba7f1ab0e3ca1d94a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002408, "uuid": "76392203-cb10-4fa5-a187-5ec3f4c8a8a5", "comment": "Malware payload (Mirai)", "value": "05b313459b89dabb44802de94eb25909a9d44056a827ef90a8f68627a888a251", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002408, "uuid": "12a05169-21db-428d-8ecd-fd99c07dfe36", "comment": "Malware payload (Mirai)", "value": "090af7a34468c9c9753cd45150d1d6b2602ceb0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002408, "uuid": "94872022-e788-41f2-9c35-c67fcf2512dc", "comment": "Malware payload (Mirai)", "value": "b0e864816cc05d2d83fd5e45d2fba832f5a8dcd4625b8947c00c3edb6555eff95a123791ad6cd1e7e22fca00720f9267", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002408, "uuid": "e8dea8df-9dec-41ef-b3d9-bad3cbabd50d", "value": "T19FD32945BC819F21C6C216BBFE2F014E331657E8E3DA72129D245F70778A92B0E77A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002408, "uuid": "b2f269a5-943a-4e25-aeea-4e0e7fba7774", "value": "3072:ybliZK6lDj8mjeUBPD26h2Te+ATa3EFzRYucxGXtz:ybliZK6lDjNdFafTnATaUFzVXtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002408, "uuid": "9d85c2ce-66cd-4c09-b998-449cb6ee86fe", "value": 132636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002408, "uuid": "8b85da3e-196d-45f6-9ef7-3c9b93f116d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002408, "uuid": "e9dbfef8-7952-4f72-98fc-70748095ecc5", "value": "colonna.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa15f8d0-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038671, "uuid": "a67aa04b-f653-4bbe-9ace-b1fd587238a6", "comment": "Malware payload (Mirai)", "value": "48c4332934fb307f5f982945c15f5a91", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038671, "uuid": "c187c8d7-9bcf-4942-8d64-1d5b8127efad", "comment": "Malware payload (Mirai)", "value": "0623222eb941a432cce79068053cb9d11c8ef491b7093350f4cad1f4e3b01f2d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038671, "uuid": "f1cdedc5-e94e-43cd-ad24-56a9c0dc52b4", "comment": "Malware payload (Mirai)", "value": "6d7b831913d376aad328d4badbeb565ef4d82de5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038671, "uuid": "d8172380-f513-4048-9dea-a760791f9230", "comment": "Malware payload (Mirai)", "value": "5f368400711042bc75a1df82403f984add3dc90e5d3871c2cc187c9a244ae621cf38471412f5d5c8446a76e0a14967ff", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038671, "uuid": "41429e94-e667-4130-a194-93cf296ddb70", "value": "T180D012DDB4634073385DCF1BE0A44589A492F46959E03E90589B3C59287ED1630F5677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038671, "uuid": "34c0a701-fac5-4314-aa5b-961d159befe0", "value": "6:h9OnFflE0FJBodAjJdyzNdyua/iKHEIDEivpv:d0FJydAjJdyzNdyua/5hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038671, "uuid": "c4aff247-fe1f-42dd-b27d-02ce3a7d2c76", "value": 282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038671, "uuid": "6ecb5548-2232-4598-8c99-c8a2dac4ae22", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038671, "uuid": "b1bb9b4d-aa49-4dd5-a657-6d023d9b223c", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c871bc-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006128, "uuid": "66af33c7-1b15-4cc5-bcfb-42f01d414a92", "comment": "Malware payload (Mirai)", "value": "24a516fe71c8f4ead207e9ee478673ea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006128, "uuid": "cc5ec085-f2da-4508-b722-6eab1669930b", "comment": "Malware payload (Mirai)", "value": "0668f903a58382a2743473618e99b29e3281e3c645b243c4639b63c9e4063f97", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006128, "uuid": "21ee2db9-2855-47a6-810f-391588f8c258", "comment": "Malware payload (Mirai)", "value": "aeb2f8c5df41050d36b38f8ec3159085d991af82", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006128, "uuid": "cbd18c7c-f941-4a2a-85a6-6bab78ad8242", "comment": "Malware payload (Mirai)", "value": "7563ef8a784fb725f08a21c6e5e181d31735e12588377510ea26f0cbdd832b6945523b2b814b37412446da6870e68b5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006128, "uuid": "3701a123-9c54-46e7-9505-fbd4e882f69c", "value": "T100E092DDA4720071B84CBE2EE6A94B5CB051FBC5AAC02B3888DBBD51E81CD157482E23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006128, "uuid": "cb1c111b-f895-45f4-8939-0487bf0de211", "value": "6:h9OnFflE0FJ6D60hMwXJfLFmfLFNfZ5B6Ea5XKbF8dvwtMs:d0FJ873JkDhy7COs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006128, "uuid": "4d371a5f-20f2-43c9-a44f-79f7fe9ceccc", "value": 393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006128, "uuid": "2b451140-5003-4f6b-9742-b6d70cef6e2b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006128, "uuid": "9719a484-ab76-4731-870a-3fe900dfd21a", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9691677-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038644, "uuid": "8b7e5b35-571f-4878-a533-7aea0fc41b28", "comment": "Malware payload (Mirai)", "value": "2d6f30c1fad72c6021b13d6f0aa0a86c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038644, "uuid": "49fd8bc7-9ffd-49e6-9fb3-e724ac54ee98", "comment": "Malware payload (Mirai)", "value": "06a02e6d90d00c50928a9aa47f31010694b12be9781886b50c712b7be1f85ba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038644, "uuid": "8b623959-e906-4671-a1b2-803a1dc7a583", "comment": "Malware payload (Mirai)", "value": "04c829615c963d0d9655b3c365ca23924c1b8c33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038644, "uuid": "fa1b50f8-c56d-4e08-b805-5347e60518be", "comment": "Malware payload (Mirai)", "value": "5b5bbed09ef6d23cf997378291f05462d874f6849b24a8b72e99dd878196dc2666f50c069dacc6ebc2c29549ce0c648a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038644, "uuid": "ceb6fb34-c2c8-4c37-be33-98debdedede0", "value": "T147313306EF1BB47CF81691F98A6703F69E21B8EC23397642AE0959020C0A9F018A8491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038644, "uuid": "7e52dbb3-8671-415d-846b-7a1347ebd1dd", "value": "24:GHOpHZAXmJSu2g4s0Amljh0aVxJwD6nujoxcozffTTqf:GH4ZYM30AmJG8wD6usxLzXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038644, "uuid": "45343a67-3a14-4649-a08e-21de49c3681d", "value": 1688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038644, "uuid": "312cdbd2-49b7-4a40-9008-e271fc573e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038644, "uuid": "86e09f49-1361-4af1-950d-7b33d54e13f2", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d4f0ed-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042131, "uuid": "e261bbb0-3f9e-4e45-815a-4b2586f9827d", "comment": "Malware payload", "value": "5b37f5fc42384834b7aac5081a5bac85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042131, "uuid": "588a696e-60c8-446a-bb77-f9f30b889059", "comment": "Malware payload", "value": "072ce701ec0252eeddd6a0501555296bce512a7b90422addbb6d3619ae10f4ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042131, "uuid": "18182732-2f85-4503-9e5f-e639b1a1973f", "comment": "Malware payload", "value": "51aa8b08dc67cb91435ce58d4453a8ae5e0dd577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042131, "uuid": "9472e05c-6f64-44de-bbcf-0e739d921e69", "comment": "Malware payload", "value": "c866757b0f2309edc69e661d3225f2d8f093732b341ae1d91bf279d5a0b4776f4c84b51c5e016715a8385c64fd7235a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042131, "uuid": "25486efb-ec0f-4f8c-a6a1-66c3545eca7e", "value": "T197822A08B7E48324E1BE0B38A8B313685975F5975833DB5D2DC5202E09B37809E12F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042131, "uuid": "a4c0d294-5409-4dd6-b32f-41ed0de5bf82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042131, "uuid": "2d8f0f2e-16db-4a37-9e58-b20d27d47f35", "value": "384:nHVOeCwqR63Jxk8GbfRvShKPR9VZwfuFnjPRWcnsW:oeCwh5xk8JKJ9jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042131, "uuid": "6b672acf-954b-4688-8bf7-7da6047a46cb", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042131, "uuid": "6262b3db-58e5-423b-9e3d-c31753d4ad71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042131, "uuid": "0c6294ee-8d7d-4d76-bccb-450314c33a37", "value": "FleetAgentFUD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b519a088-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011927, "uuid": "95de669a-fb7c-4618-a3c8-7522e8ed5042", "comment": "Malware payload (Mirai)", "value": "3ce10f64f2e6e751f0f0286f1e0a158c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011927, "uuid": "ffc2424e-0c84-4b16-8f0c-3f3a67447d95", "comment": "Malware payload (Mirai)", "value": "076c315865ca6fd0dc5e366287a032916e5d28283d65c067b0917d480c8e15d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011927, "uuid": "1497f617-9049-4f0c-8b2b-fb5308317a8f", "comment": "Malware payload (Mirai)", "value": "eb21b98d4e21ad8befcc0f17beab0becb728ea73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011927, "uuid": "1e6cd94b-7ad8-4427-bbd2-f44011f55daf", "comment": "Malware payload (Mirai)", "value": "1ece80a9e0a98f69d7a0b58911b3b004bf236e8dce3ab34f4a953da5e4a38ae154aeba546fc5aaba3c59c25e5af8fe6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011927, "uuid": "bbb50a39-0d88-4123-a4e6-0081d981decd", "value": "T18913198178829A13C6D41377FA6E01CD332527A8E1EF33179D226F5177CA92F0E6B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011927, "uuid": "7667a8c4-3ab7-44dd-aca4-3d7e5f196d18", "value": "768:dq1FLfkDDi2Ft7wmk14Oq8F+kIyHpnewS9/Nk9+mMKBPyg0klPNOHmDbpZD:4F4vi2PRyHQ6MKpT0S/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011927, "uuid": "642cb1f6-1887-4bdb-a5a2-344124c9a457", "value": 43908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011927, "uuid": "562a67e8-12c4-417f-9d7a-c60d6698f30c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011927, "uuid": "18220d2f-4a6b-4558-acbc-c08f4eae5d39", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105a75e7-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042145, "uuid": "e2001604-3e78-4f44-87d3-e08b447c335c", "comment": "Malware payload", "value": "f4ffe193f823d286a4e86a12d661a5d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042145, "uuid": "8f523a2e-4517-412f-910b-814373d20965", "comment": "Malware payload", "value": "076e5c3ba9b9b940fb4223938698a45387c239db58200d5782283d8414066024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042145, "uuid": "9b625e54-a0d8-4438-b027-2ca78a9cc29b", "comment": "Malware payload", "value": "871e390fcb8c20e9109adf353306684d711c425e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042145, "uuid": "2921a2f7-25c5-4fdb-a725-1958a4588ca6", "comment": "Malware payload", "value": "a4d09dff78f8a8f7630723c835f6db30c90ed4fe7a4f8c08ac1ade21a468368a1f08ea162e37c589a6367b89e27691de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042145, "uuid": "6b6e421d-b4e6-4e23-bdd2-6cd952bcdeae", "value": "T1FBC6CF56E2F900E8E5BBC0B8C6575517EBB1345517309BEB52A48A692F33FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042145, "uuid": "5f137c2f-87c7-436a-8d9c-aac6f4d533a7", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042145, "uuid": "04a942e4-c4fe-41e2-a519-6b2a6a8d944e", "value": "196608:BKx5ZkerI1dc9irWBGFGJ+2wI82JZSxAhYKGXRwOT:BKxapWfkTI8yhri/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042145, "uuid": "872fb916-1404-47d8-9042-9f5718298bb1", "value": 12412505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042145, "uuid": "dc7ae426-4ef7-4138-8108-4db9ff70a216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042145, "uuid": "66a31ddd-665b-41ff-9e9b-96e6f1081886", "value": "agent_dotnet_slim.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4958344-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033830, "uuid": "84b0a37d-fb01-4179-8878-7f31273b08c0", "comment": "Malware payload (Mirai)", "value": "0125a190944873f2f3cee99a3ddd891b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033830, "uuid": "63ad0977-0e64-430e-ae3d-d5d08d501831", "comment": "Malware payload (Mirai)", "value": "07e266052d5e28838c490a92def5ac5abb89a66b9176bc32dbe07dd817c027c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033830, "uuid": "a4f8f06f-254e-4a43-973d-117494729857", "comment": "Malware payload (Mirai)", "value": "321471d94528521911c92f663753ece4e7ad0a5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033830, "uuid": "e478c97a-19a7-48f2-80df-2afa2a711427", "comment": "Malware payload (Mirai)", "value": "4af3d68a7ad6bda487be14b2fdd72c8123ca20ce08a9c05111d4d46f49f8c2e9b328d67b3e6a90e631b9a972dc0bce6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033830, "uuid": "21a267c2-d136-4c4d-9264-427df2ab9ce2", "value": "T123333BC6F800BD7CF56BE3BB8623490DB930A25491920B27B7B7FDD76C311A85A16D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033830, "uuid": "16842bce-0972-43ad-a773-d52adbeab294", "value": "768:i/eTp2hZh4abfCMa0fiz2dv7lOtFn/v6FNSENPdeEjzcIC8mTC4hR:iuq4jMGKh4B/vXENPdfzcr8UCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033830, "uuid": "13331511-8abe-4519-a596-3d2d5940fd3d", "value": 51472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033830, "uuid": "bdda4387-8fde-4c9c-9078-5e201304e33e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033830, "uuid": "62e26f74-1c20-4093-90cb-24793cb3e341", "value": "b3astmode.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4bc445-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049840, "uuid": "7a4ba74d-b502-4fc4-bf83-36e481bb1759", "comment": "Malware payload (Mirai)", "value": "82603d889d3f4ff485b0c6921257182f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049840, "uuid": "dc5cff63-0cd5-4941-8ef0-9413c0b2ba16", "comment": "Malware payload (Mirai)", "value": "083debbd3af78f148afdb936d60b4066d83c5af2e1f0fed88c31cd5f5ca6ce9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049840, "uuid": "67a49901-98cd-47c8-9ced-59234e63ecf8", "comment": "Malware payload (Mirai)", "value": "dc1154f2be4fb0603fa466cfbb79902add238528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049840, "uuid": "05531d01-73c0-4dfb-bc0a-809138d90dec", "comment": "Malware payload (Mirai)", "value": "0546e8a39488ba58fa20e022423b6fb905049b054db482a518de5b2f3f61855b08699a8a9df48c43dcb099ada5fec1b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049840, "uuid": "09e60a76-7588-43ac-b2f3-ee84c47d40ef", "value": "T1B3E43955F5D09F62C6C2563BF68E825833230779C3DAF30A591897383A979BB4F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049840, "uuid": "72725c62-4a58-4470-9355-378d818ce137", "value": "12288:IU2/g0Xo8/E6Ps1XITROb1rEf1C6Z9fTI217fupMN/jPXrLZaNRIPZ/oa:x2o8Mp1Y16rGbPPpaNWB/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049840, "uuid": "a4642198-d6ad-408f-9b77-2a964eec480e", "value": 714552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049840, "uuid": "3d596a06-7939-4707-965c-229a165a66f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049840, "uuid": "f389ee74-01a7-4e4a-ac93-b512cd15516a", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b81f2b5-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765033681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033681, "uuid": "49280c8b-6c7d-4ad1-970f-080e82a4822f", "comment": "Malware payload", "value": "9ec745bbe7b8c5326547ee6b5fcbb3bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033681, "uuid": "27aaaf4d-6532-4263-9067-28ef0402bb18", "comment": "Malware payload", "value": "08e4d0b17b0f69a45d759ba1b6ff05b77d3b4a3547dfd4a25a8b9c899a384186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033681, "uuid": "5ecf3df3-610d-42c4-8b68-740bd4329eb4", "comment": "Malware payload", "value": "ec99f7dda19c987356db496228fe42000acd815c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033681, "uuid": "eaca3b1d-c881-4e20-9566-9a0f73f221ae", "comment": "Malware payload", "value": "8c80d6d057febdda9ead0c8a73b21450d594e29e3f0c1d97ff6259f7bfd4630b28c3fec3e395accc80e696bf26251ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033681, "uuid": "6f24129c-f029-4111-917a-d7c24593c0bd", "value": "T179C33A1BBA68507BD296C479CA430A05DBB2BC894781A7CF17904EDA0E77BD49F3D312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033681, "uuid": "2e9c3d28-2670-4a59-8ea2-ec46daf59f24", "value": "0d78a295a62b60bf9d5fd81489bd6e22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033681, "uuid": "e45fad2a-e4ad-469b-835b-0fa6418a4b20", "value": "3072:RxFBSOAqXIRCO7QQFDo+DAgcAwzJGmuMicx:RxFAqXT+DAgcASJGmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033681, "uuid": "99fdd0c2-8922-4238-a53b-98a9993c23bb", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033681, "uuid": "3d38d98b-fc39-446c-83b3-ede6ded1c0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033681, "uuid": "1576af2e-fb92-491f-b4b7-a23a915439fe", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80644055-d294-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1765019569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765019569, "uuid": "6c994a17-f582-4d70-9469-2712f6279218", "comment": "Malware payload (MaskGramStealer)", "value": "86d34cbba0f6ade83817f2ddc7599d0b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765019569, "uuid": "3b0d06b8-8413-490d-993c-654ac8e3f699", "comment": "Malware payload (MaskGramStealer)", "value": "090e18571bea63326ed56b61a157f8438f41a299c2dcc11ae5fc94d26418fe0d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765019569, "uuid": "226b1da0-2154-4e14-a9f8-525e3012c33b", "comment": "Malware payload (MaskGramStealer)", "value": "b7a7fb2d48371d30503eaf35f0c72bc2b8689dde", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765019569, "uuid": "3f5fa2c2-f923-4f89-957c-52ad7796458c", "comment": "Malware payload (MaskGramStealer)", "value": "969675afc114cb6d1b5a02d27387e209faa74ab9893872cb53e199616676997fb159ecf1797dc36cfc34d9d3c1381eee", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765019569, "uuid": "3ec0e8a4-d458-419b-af45-7b6214787fe9", "value": "T16B0633EAE3CEED76DA8949B721394B70AAFB210917A2114E554D62FD772333C448A3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765019569, "uuid": "32b136f4-4564-4ec4-b5aa-7e443a461526", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765019569, "uuid": "ba1ce765-aba9-48a1-9eef-51287d272357", "value": "98304:PyXb6M8W02ZIvLoBYANVSb/sD0nuAa3/81IsFQ:PyXeM8GZMLYbgDjuAaWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765019569, "uuid": "b6903f60-1171-40fe-8ebc-335534c6c696", "value": 3963904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765019569, "uuid": "b4dc9224-fd6d-4b02-a68a-529af86e7008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765019569, "uuid": "a6729e62-3ba6-4a49-a9c3-ea22d86c5545", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06997b40-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042128, "uuid": "eed767cc-a504-4fa0-9a10-c5626337e35a", "comment": "Malware payload", "value": "5a51e14eb6999032d443f4d999d06292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042128, "uuid": "cb219c2f-2ebb-4156-aa76-4bd7dee300bc", "comment": "Malware payload", "value": "091867902dc7e6399ac313774512cff42bc097c4c20d5672e941fe50129af4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042128, "uuid": "df9577dd-8eb2-429e-a37b-3b2b813d6801", "comment": "Malware payload", "value": "e45168830d0dbc1ffc68cdba744a1626090a248d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042128, "uuid": "90c8d4bb-ab43-4d04-b65f-5eb2958267b0", "comment": "Malware payload", "value": "ada0a716b9b8c2a27ab127a04798300d177322ceaeb8667d86b88b5642ff6ea8edf2c0040641477963c3be0a7eaa5e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042128, "uuid": "8846bd55-98b5-492d-bcf4-39f49e407d43", "value": "T17292F70873E88764E5BE4F78A8B3031859B0F6575932DB5E1CC6246E0DB63C4DE51FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042128, "uuid": "b1f9409e-4eaa-4f6e-843e-e4c1e031fa24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042128, "uuid": "631a84cf-887d-4c7b-8bef-2528e0c5d3e1", "value": "384:QMgXWY5zUpPyq18rAVkfUE0pQjCBHHr0lXbgRkfNvzM749VZwmI5UfXFnieXWAqJ:hYCpPyq18rAVkfUE0pQjC9bozMM9rI5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042128, "uuid": "8231ec6f-6b26-4d5c-a3d3-367325d0e2fc", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042128, "uuid": "daf76792-6c9b-4b30-8123-ed58023a9bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042128, "uuid": "689fc30c-d506-4607-814b-74695e05483b", "value": "FleetAgentEDR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca33f69-d237-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764979647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764979647, "uuid": "9c6aa896-dc2e-4b13-bfd1-043056a9e880", "comment": "Malware payload", "value": "9e137668ec9678089ae811c375aeb8dc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764979647, "uuid": "853f9fb4-847d-4dda-a3f2-4e6d0d2bd76d", "comment": "Malware payload", "value": "096f544b818c555d49f07f77a2b2c1ae911865d5308c679f77ee5ef5af9acec8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764979647, "uuid": "2a886d6d-bcea-4a6c-b205-2fe6b92d8047", "comment": "Malware payload", "value": "f3c03033040ead91ec0de1a85e5475739171c9f1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764979647, "uuid": "af37a134-a904-413f-a0fb-fcac7acc897b", "comment": "Malware payload", "value": "0d76ccbc322346aae0f43908fd4630dbe7549b6b4b331ce04bd425c32f83b340a3dfd7eac7171a2286dc7aed140a3057", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764979647, "uuid": "ad183eda-59fe-4296-8979-66f575b861d6", "value": "T195F423B8641AAEF5FA26913D8EE9CD145CF792A4926F828CB737CA0CD450744D90DB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764979647, "uuid": "b3dd98c5-0ea5-4473-8348-311ffc324ca4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764979647, "uuid": "f551c288-1339-4b8a-83e3-7a9fb503a3de", "value": "12288:MJ+r4HF9/3XIHoaIZJ+6yTVYzDpStJ5lonTsY2Xlv6PYZ36Ca1lnwZEAwMqatzrC:C+rUH/3K1ITPwVYzDcn5loMXliYZ5aQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764979647, "uuid": "f52bde90-daa4-47bc-95e3-2e6edec8dee7", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764979647, "uuid": "9531ed58-868d-4cd7-8ed1-88e0436bcd9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764979647, "uuid": "74e4a4c8-154e-439d-917c-369b8737f2bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b673961-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006112, "uuid": "7bd6ebf5-fb47-454b-9423-2027f11a34ed", "comment": "Malware payload (Mirai)", "value": "e22320914ab0ede2d0875a34b05a1de1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006112, "uuid": "6dfa27ca-5812-41a4-bb13-81909751916f", "comment": "Malware payload (Mirai)", "value": "09b4c90f5b3e7a45cae95bba99cdd6d44d10db494b38bead1c47cedeb71850f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006112, "uuid": "7e8f92c0-efad-4b5d-a7ff-3d2dde0b304e", "comment": "Malware payload (Mirai)", "value": "a550d23eb8e99b10226408acbc7f98f9eed6afc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006112, "uuid": "d88d99fa-eedc-486a-8cce-7010fe36730c", "comment": "Malware payload (Mirai)", "value": "1e3b124733f8fb5cd7f03ba3087b9ac9c99ab49f57b716523fea890b4917d5cb2fe15b1d39b0050e7646cc7c5f0cb452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006112, "uuid": "71bbb8ca-096b-457e-a6dd-d2daae0509ff", "value": "T1AB31500DFA88BD04FF14CC3899657B762F270D2F840EEE9B4D1A95B0483B54C30A42AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006112, "uuid": "0d68597e-1500-4e06-a18b-7c48a819ede0", "value": "24:PxKkiDQUpXFpcDQWpVE/tuYiAQWfqhbsfnMrkHgAiZXgzN:phPUpXT5WpS/birxhIvMrckgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006112, "uuid": "d18e5ab1-2a2c-4ce9-b5b7-13c2421dd950", "value": 1508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006112, "uuid": "c2610da3-214b-462d-8b1f-10e63364407e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006112, "uuid": "42e18835-d195-4b2c-b0af-e55f559ff00d", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c350d23-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002409, "uuid": "53c08fa5-a61e-4236-9776-c5b7ac24bcfa", "comment": "Malware payload (Mirai)", "value": "720858368c21177bd52a2380d3a12322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002409, "uuid": "60b8d059-6d65-4563-a9cd-153fcc50db40", "comment": "Malware payload (Mirai)", "value": "0a5eab3544a6c4d0516db222f7a14e5d4d32931a6991f9d6dcfa8b268c3dee1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002409, "uuid": "dd049da0-6c4b-4991-a483-9952f6b87a1a", "comment": "Malware payload (Mirai)", "value": "a0a1ef60c43578e68623893a20164dafba350f7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002409, "uuid": "9946e861-8629-4bfa-bf82-479c51191e3c", "comment": "Malware payload (Mirai)", "value": "282721992201eb48654106fa4e30fef269e364890c6a3f651dac9a40466ab4e9d6568d9d7f0b79dbfeb8d576cc77e4c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002409, "uuid": "b132f329-87f8-4bc1-9116-91d253be279e", "value": "T1B0E3AEB7FB8F0561C45606F40B8BDBDD3F6361816E6BC8E32C29253BA8361DB4405B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002409, "uuid": "5e83fea6-541a-4810-a6c8-e1520a3e0593", "value": "1536:u6iXfUUy5QyWhnYzjsCaiYQrjHy8UqFmKX7ClBax3Vz1A1ZgD4bcA5Up1M/LWmU:mMUy2y0YcijnHvUQvXOiRVz1sgDoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002409, "uuid": "38cc207c-64d5-49a6-8fbf-ac9f390833be", "value": 148804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002409, "uuid": "75edf7c0-6e85-4d89-9401-dca65e320dc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002409, "uuid": "1e5a69ff-1433-43c3-981f-e2e09771c75a", "value": "colonna.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd239f6-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981635, "uuid": "6cef93dc-2d69-4164-9733-9d278b29ab22", "comment": "Malware payload (Mirai)", "value": "7d62f4cbe6881d39f9bccea87bef5a51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981635, "uuid": "1d87a3e2-f00e-4ce4-8c78-60ae13c555e7", "comment": "Malware payload (Mirai)", "value": "0a5ec5703c803f9700ab1c8649cf4c05956e6603d4b9fc0c7f36b95c85336a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981635, "uuid": "68592461-3747-43f0-857f-094d18dbe8f3", "comment": "Malware payload (Mirai)", "value": "f22a4921dfb63edc359b50835e12bfff1899c620", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981635, "uuid": "c91d930b-d68a-40e9-a764-037485f6c50d", "comment": "Malware payload (Mirai)", "value": "775ecd835eb7c944323ac9d9f03e6a6e2192a3e28707e42413021eceda01ad8a3a5361ecd5461a5241aecf7e6c49917a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981635, "uuid": "ce2804c8-6417-459a-9db1-d9c88570f4fc", "value": "T133A34A363A752E1BC1C0A57B11F30760F2F1479E26A8CA1E7EB20E4EEF2465061576F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981635, "uuid": "43098471-2724-4850-920d-e0ba9f5fd63d", "value": "1536:MnpJV3a0ERsujU5wJNE6jDj+rSVUUkBXERYM5WtZs/H5:WpravD/+OkVERY855", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981635, "uuid": "e6376327-27a7-4359-8964-abc238396a83", "value": 99864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981635, "uuid": "7a292893-b92d-476c-85fb-6d0b111c5310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981635, "uuid": "15592161-3cdd-4686-a36e-6eafead06d21", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d553c935-d29a-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765022289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765022289, "uuid": "88cbd300-07cf-4ebd-943b-57394bec9ecd", "comment": "Malware payload (AgentTesla)", "value": "289b08a2c17bcba7516dd319c6905a9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765022289, "uuid": "e8f9964d-a8ee-4299-a5a5-9393de1fb489", "comment": "Malware payload (AgentTesla)", "value": "0b43cafd11ba4740dc2ac09aa97c63f6bef94908577a0428be6978dd227a08f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765022289, "uuid": "0594ebb2-3b09-4673-974c-08fc52b5fc5d", "comment": "Malware payload (AgentTesla)", "value": "ec9f3cdf1c5a228c20838f363041a4d3bbfc9541", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765022289, "uuid": "343b7276-9af8-45b4-9960-5c92a3a5d68f", "comment": "Malware payload (AgentTesla)", "value": "4a5c37f0214a1eae0e6031408cc1be8b57de0bec1e293eaf3f8f7f812b161ca8fe2d335711feead791af58f86f329209", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765022289, "uuid": "4c3c4bfa-7200-4f03-868b-74ef5676c4af", "value": "T18F4302A5214812D4239D92B0BCE4B96399C3C5E6EED3BCFE451B837BD1B73448EA6418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765022289, "uuid": "0d8dfcbe-c9ec-4fad-80ee-f5310c77a424", "value": "1536:Uit3K3eCM07VR+MJCmbIGuhGiZB59XyF6dRhG:Tt63R79UmbIGup59TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765022289, "uuid": "515af1a1-a5da-417d-93db-0d22c7dc39ca", "value": 56863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765022289, "uuid": "5e57e976-fa05-4471-afc3-abc4536a7c28", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765022289, "uuid": "98c5fe03-3bb4-4b3c-8b2a-aeb6e2d4bded", "value": "Invoice_Petromar Shipping_#8201B340 - Jan 2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcb1768-d295-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1765020018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020018, "uuid": "481dc9fb-529e-4a25-b471-3e98ba4f48fd", "comment": "Malware payload (a310Logger)", "value": "bf537e5fcdb7c7f12d27a91555036239", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020018, "uuid": "5c154f88-811d-4088-b7d6-d7038e031641", "comment": "Malware payload (a310Logger)", "value": "0b956b451d32c337154fc3b6906d4b6fbc13cee9225cb0a02cbaf0d64dfd673c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020018, "uuid": "ce726561-88e3-487b-ae87-1ee8255564ed", "comment": "Malware payload (a310Logger)", "value": "f1530925e1a120dd18d350b4227ded60b6d46d87", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020018, "uuid": "60654edc-4000-4485-a4f1-00aa00f3bc41", "comment": "Malware payload (a310Logger)", "value": "232bd091a63104e5db3fd41f06b1a820c60aa566e53dacc0130da3608dcef077ef47a335b247b9ea5dfd4a3fbe30b102", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020018, "uuid": "2eb2e4d4-3178-4bb0-8927-1df35d1579b8", "value": "T1CDF4238E47CB9125EAFCCF7896076F05BBB20261B0647F6826F562106478B761CD36BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020018, "uuid": "c48f50d8-28e8-4117-b8ab-7170582ce3a8", "value": "12288:1kL72KrvLvZgiWCaFhKzv9tU72z2S0vov3FEmAnxqlYWgCuHCo5P7Y43qaz9wVbd:iL72izvZXaFUxk2SXvq3Fenxq2v9isct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765020018, "uuid": "7629e636-75c7-4106-9df6-ee0c2863d39b", "value": 767986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765020018, "uuid": "160a6326-7928-4f61-bb61-f51dba7ae322", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020018, "uuid": "561c32b5-c58b-4494-b79e-33ee4580f1e8", "value": "PO_3429010000046093122.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749ae360-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037589, "uuid": "c732e569-d777-4d2c-8495-dcdbeccaf572", "comment": "Malware payload", "value": "0f3495e73303461e46e94c75896a539b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037589, "uuid": "40047731-8412-435a-9c94-0a376bd56516", "comment": "Malware payload", "value": "0badd9b4b0e44daeaa75b5d97ed9611a9f84418c1fb5683130e8b22742086549", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037589, "uuid": "44ee8071-0a2f-47de-ba84-729a5ae76824", "comment": "Malware payload", "value": "bf7daf8f137c00376e7d25ea44e9dcad31e933ae", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037589, "uuid": "4b85b0c0-1d6d-4490-8ea9-b3cb2cf95366", "comment": "Malware payload", "value": "957b33d18b742020c0730c3907230a19293fc76a98fbc3472121e68ac3dcd24e18c753e99ddfd65203fa4b19e4535781", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037589, "uuid": "74b4b09c-2524-4d7d-9506-dc37b6ad965d", "value": "T1E9761203F78E4D2ECDE2B97C4D9713716A156CEC1910928B4902F218BEB72E96F25BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037589, "uuid": "8f03be20-ab68-4345-b47d-fbd9fa8a05ff", "value": "98304:LDfUsbILnAZ0ZI9/P2hnWAjVOA3I/0fg1cPxhmc4aTc2s0FJXzQyapA2Au2slvFO:3SnA0lhWY7y0fg1UV4KX92N7vF7exB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037589, "uuid": "487191f1-a1d3-4fa1-9143-5c86f0275bd3", "value": 7369993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037589, "uuid": "7a0f9f26-11c9-48e5-91c8-ca11381c469f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037589, "uuid": "cda74aef-e84f-4150-95e7-afff4c0bd329", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84519558-d29c-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1765023012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023012, "uuid": "446e6147-0ca0-4d95-b1fd-bc6f3a740ad5", "comment": "Malware payload (GuLoader)", "value": "1ae689141f532e7e1d94b19e8973ed3e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023012, "uuid": "e78c849e-111f-4620-9a43-48144b0037e9", "comment": "Malware payload (GuLoader)", "value": "0c72a4f35022e016397cbc277e389fd0e79bb589fd918fc574653b0418de0252", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023012, "uuid": "eb05c16f-2661-4828-8a02-756f978ae556", "comment": "Malware payload (GuLoader)", "value": "8cbfedcfa0df2d473e7e95cdef7daf371f6b2db7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023012, "uuid": "47421a19-51bc-4617-9e89-7593323ef7f0", "comment": "Malware payload (GuLoader)", "value": "4257756e3c8f4cbdb87e29e38ce0dbad3f42c22b974e40dadb359e17c9a13fe80a66009f543b2087ce2ea1a59a8ca11d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023012, "uuid": "64a59e85-be5b-4ffa-b8ce-3da087a300ad", "value": "T1F7D2E1268433D598E92FA652EA38424D8E37FE182249DD7FB204D61CEFF30631B56C15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023012, "uuid": "e4764826-8dd5-4b36-bebb-175dbdbde286", "value": "384:o+s6N6u8huXqOEfzh/e8MiMgyjwYYx04xqL1qNKpKd9dDmf0kwMRXNKV/s08z0fr:Nse6uMouxeFDwjiRL1UD5b0K5szz03i8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765023012, "uuid": "79816b1f-092d-4e3d-8eea-af43160c8fb2", "value": 28344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765023012, "uuid": "59fb4a9b-d6bf-4c86-a972-de3a192a6b12", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023012, "uuid": "c695e54c-b888-4f3e-978f-58cd09c1d327", "value": "Bestellung 2621064552.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85aac670-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002398, "uuid": "9ca2fbe3-e59b-4fbd-9716-d8cdd165271f", "comment": "Malware payload (Mirai)", "value": "e7fe5b124b7d865ca611c0ddbf0fef28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002398, "uuid": "b74ce2a2-1eb4-48f3-8cf0-095c5b6a2b22", "comment": "Malware payload (Mirai)", "value": "0ce73cb4cfcdf082c4f4b4b4c95be44aeeb326cb74a7374e7be6fe922a5d50c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002398, "uuid": "784d558a-f972-4051-b2e2-a5da04482e93", "comment": "Malware payload (Mirai)", "value": "5e51e1572ffea1df8523a1955e8d9ca592dead36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002398, "uuid": "fd408337-cb11-4d70-b0cf-72bcb069febf", "comment": "Malware payload (Mirai)", "value": "0243fc6b681c2b518d60b3a3713cb10dc1a41ba566486c2e8702921d461058dcd442782e9f19740ff0ff4b13edf4f23a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002398, "uuid": "601e09b6-baf8-481d-b9b1-002ab98e43a4", "value": "T18BB34B84FA83E4F1DC122538306BAB339E33E57A6235EE97E3A85A335C12641D50776D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002398, "uuid": "e6d336d5-3c05-42a9-952a-e7cf1f7af672", "value": "3072:MVu5+TWFOxDToqduiR69jIfX6JehFtOZ6QAm7xDm2aYby2:M458WcxDdduiRIjIfntRmIFYby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002398, "uuid": "12d8b787-86f4-49f3-99ef-94fad608f0bf", "value": 107664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002398, "uuid": "570dc80d-5d6f-458c-b637-2e0c58ff4ef9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002398, "uuid": "3a010afd-bed7-4566-b130-af16619524c1", "value": "colonna.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0259070-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050117, "uuid": "060919e4-9bef-49f7-a4da-2b2b7c9b8b2d", "comment": "Malware payload (Mirai)", "value": "bc14da1b32cf7872120202e12b605b1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050117, "uuid": "3cc171e6-d715-4773-a0f8-6a9cd863026d", "comment": "Malware payload (Mirai)", "value": "0e86e6afcde03481a0c7d372ae2a165e67bad63f4aeef7cbcb38ad357331e1d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050117, "uuid": "20143847-34b0-4f96-ab5b-d4a7d14c1c66", "comment": "Malware payload (Mirai)", "value": "3cf44ef4c55e52eadd9532cd29551a0499bcfa13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050117, "uuid": "3b0711b1-14ae-47c7-8652-70175eb3b4b1", "comment": "Malware payload (Mirai)", "value": "8c44ec766fc4a5e3a525c66cb8d2ed3998013c75dd035e2e690afc96c08d0c96fd26b284037d827e2846867f8139581f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050117, "uuid": "c4a9df54-af23-4ea5-ab7b-2fc76b4b8114", "value": "T123043A46EB414A13C4D227B9BB9B424533239B64D3EB330699287FB43F87B9E4E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050117, "uuid": "5b52746f-5a79-4c18-aacf-4491b7f85685", "value": "3072:DccI26qIcztpa1g5rvJ1/IR0JLEoQ8pnPkXF7SpbWM/9DsgOU:YcIahpaW5rvJ140JLNpPk17SpqM/9ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050117, "uuid": "6c94113e-2c1d-492a-97d8-927ed6ff8f4f", "value": 177811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050117, "uuid": "e87bd01b-f507-4f44-9707-17135091b425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050117, "uuid": "5b7a8b15-ad0e-4493-b8c0-fa6eff3177db", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df5abdc-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006117, "uuid": "ee82852e-6d90-47a8-aad5-49ed4102bd18", "comment": "Malware payload (Mirai)", "value": "f5603ea5641f7798be320f37aecfb1e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006117, "uuid": "4133e6e0-a531-4119-9965-3ebf4e530d31", "comment": "Malware payload (Mirai)", "value": "0ebbee002097fb71812a1a1e847f80fc7de3b2819dff4c0c30235606965b6270", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006117, "uuid": "9e43a887-b5be-4813-adbc-196fc386d372", "comment": "Malware payload (Mirai)", "value": "c2f67664badf48314ab3f53f4b2ffa5c22155b9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006117, "uuid": "3347cf88-8474-4996-a49e-99dca45b08c9", "comment": "Malware payload (Mirai)", "value": "9f0344e0bbe88a64bea0e0ca52ea9a5af99e4aaeff93d13b37e17b8c77894eb23ebc572c8f0619bf846369b69aa379b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006117, "uuid": "82751355-d425-4bfd-b079-3d2e5c006de7", "value": "T1E8510F9F1A12DFE4F0A8D53847B35E65435A13DB22E59686F1ACC6000E6234D9C5F6F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006117, "uuid": "181bced4-a095-4443-a89e-f480ee3da324", "value": "48:BudpwV2iITi2QkjNikLpt6wqJkCE8EUPSHkInzHhmVAuPHx79dL+mZfKqubpE68y:odpwVtmi2QvklGTE8ESSEIz4lphdALXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006117, "uuid": "f1621a36-c699-4360-9261-f373f85f0794", "value": 3052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006117, "uuid": "2cbe6a8d-7cbe-481c-9302-4b3ed7926c0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006117, "uuid": "ad0c4b0a-24c5-45fa-aa99-c9b5bfd4b732", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e9f834-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042161, "uuid": "1bd979ba-51f7-41fd-9d2a-8392f7e41e2e", "comment": "Malware payload", "value": "9d963f85812fd02e382a48c41fc0387e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042161, "uuid": "a6cc3dbe-28fe-4faa-ac17-b2b145b844a7", "comment": "Malware payload", "value": "0ec3fca58ef8f0d9f098cd749dd209fccda7cbf68c1eecf836668e5dabd6f3bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042161, "uuid": "7dc7373f-72c6-4c21-a61c-55e4ae074f25", "comment": "Malware payload", "value": "0102782950619820bbcd60efca256c907403cfb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042161, "uuid": "a158ba0f-2214-4047-804d-0568999a2244", "comment": "Malware payload", "value": "108fdd5977b134a33fce8d0e73e18499b67b47a37f1a1ddd00dc30473316ece923187c0022c381ddc86105564106b154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042161, "uuid": "5db65f30-ebd8-41e0-a55d-e6c3cd9c0d6f", "value": "T14172290573E80625E0BF0F3C55B241181A76FA6B5936DB6C2CC5126E0FB37849A10FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042161, "uuid": "1140c964-7e5d-4ae1-94f7-e68eb451f6dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042161, "uuid": "4f106c17-cb3e-4474-af49-351a8d3f1052", "value": "384:5p8mMh7Y8u3gL9wGt0WR9VZwOox3Wqn7Tx:LrMh88u3gpT0+9Gln7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042161, "uuid": "eedca51f-279b-4e8e-a5d0-4b824a18c821", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042161, "uuid": "b478b2a4-a378-4175-bf98-142cb02cfd0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042161, "uuid": "1ff88164-df01-4169-a1e3-891fbe87cf6e", "value": "agent_xworm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef686786-d2f8-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1765062705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062705, "uuid": "67986dd0-a9d8-4b12-8881-e02303e5921e", "comment": "Malware payload (OffLoader)", "value": "379af136be94c87aed5965df0c0666c8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062705, "uuid": "c8900e20-eb0d-46e7-8e09-5534e0075c25", "comment": "Malware payload (OffLoader)", "value": "102efcb7d66f1fa608c7433ba29a0ccd907dd38db19a49ac3c06f42b694a37b3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062705, "uuid": "203a9f84-e0ff-4d43-8b5c-e5dfcd1ca867", "comment": "Malware payload (OffLoader)", "value": "b3c81e7e46f9d28f000ddc6c1fc0a8f828e60bdb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062705, "uuid": "1c9481fd-3bc9-4ec6-be93-387d53c7cf7c", "comment": "Malware payload (OffLoader)", "value": "d372ba849cdcc7a3b21d628c3bfaaada395190b21492ffac405144ad6fc1aeef654fffeafac8e82a03d38ecded735ee8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062705, "uuid": "69c7b2cb-b5eb-45e8-b6d8-ebf4af14e888", "value": "T156073337A28A623EE0AA4B3759F2A110193B7B61610F8C5796F00C9CCF6E5701F7F656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062705, "uuid": "54a3f9ff-9852-41a9-a8a9-c98abf1730a9", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062705, "uuid": "0d018979-ed4c-4b81-b6d7-44b4843eeac8", "value": "393216:oxQXfY3b25yW2ENaZwY124kkWNEvVjskBPlILzC9CT:tw3b24teqr24kkAEvVjv9KLzC9CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765062705, "uuid": "9c14ae26-a8f3-4574-8519-d5a33519e66a", "value": 17987288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765062705, "uuid": "cbc23b57-603a-4b8c-9a54-bbae753d025b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062705, "uuid": "54c30a70-7360-4be1-a9c5-2d2f6c683f74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0b611d-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033900, "uuid": "29e70021-c0eb-4736-b767-573b27a8d37a", "comment": "Malware payload (Mirai)", "value": "405d425da85bc1e6f1b23b4a78264b87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033900, "uuid": "ff886a4d-a366-40b8-a2d8-32111e3ebef5", "comment": "Malware payload (Mirai)", "value": "1071b644f0f850be4487f92ae33d909e82af91f0df25e63a4e5cc044e4946022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033900, "uuid": "4bfe3e35-e556-4bf5-b1a7-ab32070530ed", "comment": "Malware payload (Mirai)", "value": "4c1d9825bc8a309a5f08d2336e29f9447c92fb5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033900, "uuid": "10705958-0c1b-418b-a6cd-0a8cb3aa0a46", "comment": "Malware payload (Mirai)", "value": "856d2afc4626c822d340d7bc47781fd4ad6f3db0bb97ed067a052d6bbd9acc13b98ac581ff2f4680834e52fe9d946d87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033900, "uuid": "4aa808c1-fe7d-4f46-9b74-710d70ea969f", "value": "T1DD234A0177A84E07C6572EB9393F13C0877BEE9122F4F685694F8B4A4134E33458AE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033900, "uuid": "2e4ba2a0-a5ec-4808-af15-836519b66189", "value": "768:+4YGxRsghygCC5GJyMrdS+4cgwjw9LYybg9fhIM/2DLD/i:GYHCRBdSdbWhISgLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033900, "uuid": "688934ba-106f-4946-9b07-08513da7c38d", "value": 47384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033900, "uuid": "7cd9e703-3580-4971-80a1-6f679eba162c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033900, "uuid": "dc47870f-78f4-48e2-b8bf-5331fcc0bb3c", "value": "b3astmode.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25581259-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043469, "uuid": "55ce4077-afe1-4055-9ea8-17e19998c595", "comment": "Malware payload (Mirai)", "value": "4893e3166c4cc3bd5d6e445491be4a95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043469, "uuid": "db325577-012b-4d2b-8e6a-b0457710f8a7", "comment": "Malware payload (Mirai)", "value": "1087e419327971f9df908df5a41aa0605a504f46328662519ab517e325883a61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043469, "uuid": "8344274f-2907-43c8-9508-28c346e68719", "comment": "Malware payload (Mirai)", "value": "af9264bfb977fd48c8b376d368612f8b0b0fdf92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043469, "uuid": "f0740af2-d695-4e39-afdc-c8e37492b6fb", "comment": "Malware payload (Mirai)", "value": "3a4126dd5c3db54606eed6393dced8d0235056f0392513edb9ec986addf82ff485cc10f8e425fa3417edaf77783710a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043469, "uuid": "b31b1579-8e8b-4e4f-82cc-fe8a2e1d03b1", "value": "T17D53AE77C8396E64D25581B0B8748E792B53F88482571FFE1A99C27A8047EECF6483F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043469, "uuid": "7b45d8cc-2cea-4fe5-9216-7256ce0d16b1", "value": "1536:caCwtuAPFqcgdEcg5KU3AwHup+CSXHld5Zo:c58PMcga5AUHup+5FPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043469, "uuid": "c420f5d2-c2bd-4c2d-9d50-57f994f25b60", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043469, "uuid": "35138608-4f89-4d55-b063-c16e399e02b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043469, "uuid": "e8d4b93f-702b-43dd-baef-ff36799404c6", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0bcf52-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042220, "uuid": "5e667cd8-5861-4367-bab3-053ef5393d7e", "comment": "Malware payload", "value": "c031054f6140e2c366eaf4263f827dbf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042220, "uuid": "680e6bd8-980a-4e92-9e69-dc8333aeb835", "comment": "Malware payload", "value": "10eb1fbb2be3a09eefb3d97112e42bb06cf029e6cac2a9fb891b8b89a25c788d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042220, "uuid": "5eeb53cd-ef37-40ee-92d9-df209d45476e", "comment": "Malware payload", "value": "c2f5519f00249aa1511c26a93165bf32f3b1efab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042220, "uuid": "50b626c3-80d8-4440-b3a7-bc4b47546947", "comment": "Malware payload", "value": "39d69d374c716688e711db04c6f7c22684a5ec5e60bc07e994a5e14250359d28886bf034fd91172a05ec78df7aeb3ed5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042220, "uuid": "7a84db4c-adea-4905-8e83-a3f961260198", "value": "T1E8C47C07B6A45069D16BC074835796B2BB33B8991720BEBF03E092382F56FA15F7D709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042220, "uuid": "b1ffddf9-16ec-4d23-8647-51ced9435c86", "value": "4fc7297d3a697a0b65cc0078289b4615", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042220, "uuid": "c10082d1-9925-45c3-814f-242fbf19aaed", "value": "6144:rDiNAXYm/OFeEyEi+1fYyL1R+Z2clPfESSxfY8hzbWwYWHaC/77qq7nmvBdNmDdI:f1XyjJI2c6PxQ8BHLDzmHASKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042220, "uuid": "5afd2f83-731b-4d7a-9e7b-11854de7602d", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042220, "uuid": "e9823bc2-cf5c-4c40-827b-9621fa70af7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042220, "uuid": "dd052a98-e5bb-494f-9262-a11536869c6c", "value": "killer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d16f4c-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011920, "uuid": "81d0a65c-c258-4498-a7ee-67eb63d6346f", "comment": "Malware payload (Mirai)", "value": "80ffe10d22bfa589fce6977a80a755ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011920, "uuid": "7aac5afb-2869-4bbb-be9a-dd265c324248", "comment": "Malware payload (Mirai)", "value": "124f29b81b1dd425487434c9a5f2d83387d1ccf1c02e5d72276ece3618282e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011920, "uuid": "4b6ae86e-d25b-414e-9a09-79ef153fa196", "comment": "Malware payload (Mirai)", "value": "26eb39cd6f8852b0f2d3e2a6d31d0d36c056dba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011920, "uuid": "41012009-f0c8-4b7a-bff8-2495a42ea12d", "comment": "Malware payload (Mirai)", "value": "6467ae28993a277a011f9a3a3d5012370a119d381998770225c19c3168d6d974e7e063e3b05e2e8a032530208c4a1b47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011920, "uuid": "e1682dcb-e0b8-4af4-ab24-e7a3b7965071", "value": "T138F2E8927C929A27C6E4237AF6AF418D332173ACD2DE3227CE115F187B8951F0D67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011920, "uuid": "303a2cdc-7b28-4c90-8ffa-f8fefbe9392c", "value": "768:xdnvmdmyNY5++bvxA5dg6I3dJ1bIyypHDwDoCerCI73e9u+vYGPN:7+m1Q+b7yyyp973eDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011920, "uuid": "94f4fea2-f84e-4058-820c-ac0d34a119ee", "value": 36224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011920, "uuid": "de40981d-d63a-4c25-a735-01a87344c1eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011920, "uuid": "69881a0d-8772-47ff-91a9-00da2b2d0607", "value": "hoho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25969e61-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042180, "uuid": "37e2168e-5cf8-4789-acb7-9f475ce91610", "comment": "Malware payload (RustyStealer)", "value": "dddf209542b4cc9ab4f312eb46876aa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042180, "uuid": "475b08ae-0c1e-40ec-b46a-ba055bd20ad8", "comment": "Malware payload (RustyStealer)", "value": "1252b4a85ea6d33651bbcee4708f0ec14d5915f7ebe9c8de0ffb5bfc6ad8f412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042180, "uuid": "74c4b0ed-b53d-43ca-853b-794a380033f9", "comment": "Malware payload (RustyStealer)", "value": "7b7db113669abe951b5298f5a17d9fa4c2e0b84f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042180, "uuid": "bb262aa8-8e10-4d86-8734-3c6748db32e6", "comment": "Malware payload (RustyStealer)", "value": "2547f37c5320c68abaa97aa99e490a9a9679403c9cf45094e0dd4012af6aa3ca3423ef5f4caf93268804ca99df9f069a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042180, "uuid": "5c66747b-aa56-4a4e-922a-4529008282a5", "value": "T154159E1BF695A2BDD55AC0B493068A72B536B4CA0621BDBF01E1D7343F96E620F1CB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042180, "uuid": "c7165730-4351-4cbd-bffd-97406906bb3c", "value": "87f0863ec927249773659ca301d7b700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042180, "uuid": "dbc8e274-726e-49f6-b4c6-3103bac3f8df", "value": "24576:LH/Ls1S7APHLeQWzxfybcolpt63SEo86M/DS9:LH/Ls1EcfWzxqbcoLt6y86Mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042180, "uuid": "ce84bf01-8805-41d9-8d6f-25bb219609dd", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042180, "uuid": "fae77a72-1862-47d9-9aa2-fb76175e0ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042180, "uuid": "99507fce-b022-4f4a-b78d-4b2eb6b363b2", "value": "dec_pc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b616c53-d2f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061679, "uuid": "3d2b595a-5139-45c4-bae8-8518885b5964", "comment": "Malware payload (Mirai)", "value": "a810be91d4007edd0083a7cfcf5928b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061679, "uuid": "a0d13784-fa51-4515-ab43-ad6a9919c4d5", "comment": "Malware payload (Mirai)", "value": "12c29a253cfc7deda607578b50b00cf904bbc0a556b3f23c15c9bad8e9b8b5b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061679, "uuid": "413a788e-f46b-4ac9-b38c-0405c5832d35", "comment": "Malware payload (Mirai)", "value": "7b468626cf15aa762754b4a2c4302df6eaef40cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061679, "uuid": "7324e13c-2b06-4be1-8060-e7249e4e82e7", "comment": "Malware payload (Mirai)", "value": "d5f0f50ed03313f15936e8420935476aba6e57f7079d178b8d93b3417b8671d6813474fdc65e61cdfd939e1b9fa22978", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061679, "uuid": "d63db10e-ba2b-4806-892d-7966a510dff3", "value": "T173634C317A351D27C4D4A47A62F34720B3F2975E25AC8A1A3DB20D4EBF61A4036977F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061679, "uuid": "5dbd9133-25d0-46e7-9b77-6e5f61f74eef", "value": "1536:8KFgEo1OWqZrrkAopM4p+bOzSA86eQ/YD5vgtjI2l:35WqdBaD9/Y9vOI2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061679, "uuid": "2f79e7cc-d890-44f0-b3f7-2c594f988746", "value": 68200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061679, "uuid": "c48aac18-3858-41d6-83ed-b7eb76683509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061679, "uuid": "47372f39-a573-49ed-8479-cdc868849336", "value": "fent.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4cb4a4-d2c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765039400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039400, "uuid": "8b4cdd85-6ba3-49fa-8a56-2149745b5fce", "comment": "Malware payload (Mirai)", "value": "0601d5f594ee98ef7b34fb60da66394c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039400, "uuid": "f3689607-8a74-4282-8058-e1cb4e94ae40", "comment": "Malware payload (Mirai)", "value": "134bbe4ddbb9bf8018567f0ba9bd54301a5ceb1a68a7c001e667df2621a41788", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039400, "uuid": "d1c8aaaf-3eae-4631-a9a9-aef7bce397cc", "comment": "Malware payload (Mirai)", "value": "8d9bb53ea39dd69bf4d283e19e1f87c3738da5be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039400, "uuid": "03996161-410a-480e-ac0d-5f68aec81cb8", "comment": "Malware payload (Mirai)", "value": "a18633ee5e0d6d33289b3d87d391cb9b123d119486b45786c3de056e1c1aaca6715b23c9222251a2b8b9cbb23ed9fdc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039400, "uuid": "cf49234d-fed5-486c-ad30-febcfb1483c0", "value": "T17763F745BC819B11D5D822BEFA2E018D33676768E3EF7112DE211B15778A92F0F77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039400, "uuid": "d01fcf6a-e467-488e-a64b-cbf2c5818e4c", "value": "1536:dxn9pfn5yMWI15CqB5iAzBfXg4s9R9l83i2rETQiQu:nf5r/LCqB5iAzBfXg4HrrErQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765039400, "uuid": "407fdc12-0638-471a-9891-3805cbf410d9", "value": 71804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765039400, "uuid": "63d00cfb-4be3-4762-8de8-35d9fd5c2aa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039400, "uuid": "686bb3cd-8f21-4ceb-97a5-5756eb363b67", "value": "z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35406875-d2a0-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765024597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024597, "uuid": "077ca774-1c5a-4b06-9111-84a1e4b58981", "comment": "Malware payload (CoinMiner)", "value": "0ebc1aa375125e74354ef93eca1efbbe", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024597, "uuid": "730d8df0-40da-494b-b597-638d49fa5ef8", "comment": "Malware payload (CoinMiner)", "value": "13675cca4674a8f9a8fabe4f9df4ae0ae9ef11986dd1dcc6a896912c7d527274", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024597, "uuid": "22335da2-1e97-4b9b-89b5-c9e3a7e26804", "comment": "Malware payload (CoinMiner)", "value": "7c8010d9ab6dfdc7a99aba7075a793260acbf2b8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024597, "uuid": "9153324f-3dd5-4314-9578-d25f82fc7fef", "comment": "Malware payload (CoinMiner)", "value": "e8270dd3232161700cc624975711ce17a25e9e8e4839106a3f03784f153b2691ff2f2a148eb73520c219152d456de5e5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024597, "uuid": "06353f04-fa21-4f62-8a2d-fccfae1d39e9", "value": "T1E231642696A454B49E8F0179AE953340253A70476E49BB5530FC20629EFC513073AAF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024597, "uuid": "367a3254-8428-48c9-80d7-537f353867ab", "value": "48:rycTBYjvAqH3g6uCO8R+nTNbt8S8gEapvnL:yAqHQ68MwT1t8SdPpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765024597, "uuid": "cdccb2d6-4d15-4219-b302-5016d9d4986e", "value": 1615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765024597, "uuid": "81605119-4c98-4ef0-b02d-183d7c732d58", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024597, "uuid": "acd6746b-790d-49b7-aeff-30b2aa299088", "value": "sex.sh.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f363d04b-d250-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764990557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990557, "uuid": "364611c6-8e21-434d-be7b-a4d37c5e420b", "comment": "Malware payload (Mirai)", "value": "66b03b520511c1f89653793d0547a89a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990557, "uuid": "3ec9b906-9086-4172-9cda-0ed24e664de7", "comment": "Malware payload (Mirai)", "value": "14060b4f4a579859e01bb149145e3377665ff7dd1ab16bf01227be95249af38c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990557, "uuid": "57dfd497-de19-423a-a8ec-28104d85bc34", "comment": "Malware payload (Mirai)", "value": "39f90f46cc24f6e671376dc16bbcad8c532e0219", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990557, "uuid": "f6b959de-6b9a-4335-9eeb-d7e968ee6b2c", "comment": "Malware payload (Mirai)", "value": "fbe4f6f8000753c4bb636b98cd234fbbe7ff49b87c2e1b40c351c4341d2952da217a7963c88dd4ed5429c904e5d9f7e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990557, "uuid": "c55f5e59-53da-4cd5-a082-bf044a244b73", "value": "T12104D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990557, "uuid": "e15ae233-0b03-45ec-9b46-69cd8d7b4cfc", "value": "3072:ueEksFM+wX5O8aVR8H3NaMZOTTMJxt9U+7fKbvE:ueEnO+wXsVWdaMATwJHy+uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764990557, "uuid": "faf554c0-73b4-435d-bc97-5a7f942d8ad0", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764990557, "uuid": "99c4344f-6784-446c-adc6-e9eed1ac4309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990557, "uuid": "1a2a6ad0-445b-43ef-b347-f3b9d49dab1d", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe10085-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765049177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049177, "uuid": "6f76f7a3-ff63-414a-91c7-7ac98b705679", "comment": "Malware payload", "value": "49be89adb6fecae36a66c9ba826ad406", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049177, "uuid": "79542bc0-2a7b-4e35-953a-1a230d55d49d", "comment": "Malware payload", "value": "144272513db4722f1bcd187881543c19aeec77be4c5ab40dda7ee96f710a1187", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049177, "uuid": "bc02f9e4-3079-423d-9d5e-966f84d9b291", "comment": "Malware payload", "value": "f36f1da8b77fe11f55e554d04ee3c2b0e85a9059", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049177, "uuid": "8a66b182-d521-4185-a079-d6e3470579b3", "comment": "Malware payload", "value": "bde50eee0cfa86ca7657e4ff26bdf0650cf344fc244c0a0f4f26fc7954c3c70d11e8f181ec5bf4c673d9dcedb8190813", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049177, "uuid": "4b33256a-87a3-4041-be51-5d07fa39d930", "value": "T1A8418ACB50910BF7ACA0A833B76549A4FCD0A09694C15F462EDC3CD54CAFDECB819683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049177, "uuid": "b673a331-17f8-4441-8dbb-e079fd62a435", "value": "48:14dd8R4mRttQdM47g4Eb4Yp4xTu4h24Tw4mL34M5v4Tw4u74vT:14dd8R4MttQdM47g4Eb4Yp4xTu4h24Td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049177, "uuid": "bd65c6bc-7a29-4440-b367-62eb935882aa", "value": 2153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049177, "uuid": "26ba2568-27d2-41f3-ae48-a316377f5f68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049177, "uuid": "48c24011-842e-4ad1-8140-3445cc0e61a0", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc7f36a-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048930, "uuid": "d60286c3-a4a8-4d01-9844-631d0b4b1597", "comment": "Malware payload (Mirai)", "value": "513559acfadf09eead3b55be2f9e0d65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048930, "uuid": "a61af86d-6c82-4544-80b2-e0b019abe22f", "comment": "Malware payload (Mirai)", "value": "147caf69254733217301e4bca0fa88a3bca99c0f0531e878f261186a415e0d86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048930, "uuid": "04039d4d-75f9-46ae-a19a-553c585aa989", "comment": "Malware payload (Mirai)", "value": "185805e15a55ad1d02f41d4328c244c4a2559e40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048930, "uuid": "8e66487e-4b43-4480-95a7-4622503c9dcd", "comment": "Malware payload (Mirai)", "value": "44f09599c073a9056a1b7add2362db88080f99b11d6f03ba841d2f4eeae3bd1495fac5c3a18a04fdcc698f4e63a3cacc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048930, "uuid": "c32935f2-40f2-4013-86d8-34230bd50b7e", "value": "T15EE34D99F402DD7EFC0BE5BE44670E15F93093A13143172E529BFDA3AC311A61D26E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048930, "uuid": "ad2c9d16-ef57-4645-b1cd-12386e6362a8", "value": "3072:RmmyBVk2SJgv+odV0+owYl10cvjvF9JrT7vybB1:8S2SJgWSowXIvF9FabB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048930, "uuid": "5fda0d97-6244-4e82-bdd2-8ea38a050ca3", "value": 146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048930, "uuid": "872374c3-0a46-428e-b413-bafb2319c4e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048930, "uuid": "1226e049-41f4-41d9-94c5-b86544787f20", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4030fb37-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042225, "uuid": "d40e3f04-5474-4c3e-9bf4-22074d3ad35b", "comment": "Malware payload", "value": "1a641889240a57fd236dd4aae394f2ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042225, "uuid": "b2c20511-03c7-401a-8e39-4ff7a3f2edb1", "comment": "Malware payload", "value": "1487e05055c2b8488094e9b7d90cfe47d91704fe07be25853b56b85a6f995339", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042225, "uuid": "30343855-adc2-405d-b4c3-276e0c01fef2", "comment": "Malware payload", "value": "1964f320c0b6f190efddf517eeecb6b42a4236a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042225, "uuid": "07fa3371-0445-4ddb-8275-4e9c2c7c93be", "comment": "Malware payload", "value": "bff8d1b220b2a41f4fac8624977b8623ce2e16b0f943f42a0263d18b1d43b7382ef115ddebea4987b54935b1b7ad6e6a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042225, "uuid": "0666df32-8d40-4c44-917b-c5af496624d6", "value": "T1B2A48D56F7A81668D06BC074C3539672AF35F9A92720ABBF03D082381E56FE15F2C719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042225, "uuid": "73378802-3a59-45b6-afe5-bd91d04f8f55", "value": "54e71dd6ff09fd569a5edc86ee874acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042225, "uuid": "3f29fc1b-5f4e-45e1-8e74-35c486b77382", "value": "6144:XB2Orkz0lCHDayCmqswOR+DfmFV16ewmg7OIlrFEOTgdgpSzGvraxu:XsGQRqHfmFV16eoOI9FEOkKWxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042225, "uuid": "2c76de4f-71e0-478a-be95-6b1f79a88b1a", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042225, "uuid": "c0b64951-6572-4fee-b3cd-23df09a24d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042225, "uuid": "926f72b3-b14a-4909-96fa-e28dfa0c29b9", "value": "killer_eset_mbam.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e32854-d2c3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765039852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039852, "uuid": "a173edc6-a36c-4809-8ab9-9c89dca9b46d", "comment": "Malware payload (Mirai)", "value": "e52a1e47acbd36bc2159dee9c22abd00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039852, "uuid": "e76194fd-caf5-43e3-8a32-d4e0d540ab59", "comment": "Malware payload (Mirai)", "value": "14ed7004887e11c1533cf69c59671f580ce606bab224e0f119529677553ce33a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039852, "uuid": "a9669be0-be21-4e9d-bcff-47c677af836c", "comment": "Malware payload (Mirai)", "value": "d4331530c748a847caeefa06a63d30a46f4e9078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039852, "uuid": "0588594d-b87a-4130-a2d5-1dbf1544088b", "comment": "Malware payload (Mirai)", "value": "763e9ddaf5cd2aa44263a5dce06d558a59df0780a19fcda868734520a8bd48db00cd30010cee3eb1709b954d8d948502", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039852, "uuid": "a6664989-2545-4429-8e5b-5543fec8f116", "value": "T14EB34A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039852, "uuid": "df35f292-03b9-4e25-91c4-400601e822e8", "value": "1536:1a97/6/q0AmnClsL9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/zB:1y6HClsZn+MCISxPKO8WL7t4LbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765039852, "uuid": "4cd2b726-eaa8-40a3-add0-bad7e35b9abf", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765039852, "uuid": "8d6bd061-6a01-4f5a-bc7e-c0798010338c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039852, "uuid": "59d9ab69-f67a-480a-8bda-250954fa812c", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709d743f-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049178, "uuid": "cc5c8e12-700b-400a-95b6-7579018b68aa", "comment": "Malware payload (Mirai)", "value": "a66415d13c7da85cb378612bbf6a0497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049178, "uuid": "7fdc1b41-e2f4-4893-afd2-f78ede0a3371", "comment": "Malware payload (Mirai)", "value": "15c213842cc5a9f5f74d18d066085204f7f07f630785b1b7d1d02cebccc0a956", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049178, "uuid": "9001e5f4-5fdd-40a9-8a2c-9f7288eaa99e", "comment": "Malware payload (Mirai)", "value": "ec6d35516de4c903a280c5c2f5a5651a8dfe7692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049178, "uuid": "6ddadbff-5371-48a1-9096-4fe29aa5ba1a", "comment": "Malware payload (Mirai)", "value": "7b24149707a08ec43877826c67ae7497a3e5819f8eacaf9d14b89ca271d94aa2c8d23124583b2f07d72e01485138724c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049178, "uuid": "e4fae9ba-eafd-4304-93dc-4562e60c69cc", "value": "T19E74E046F7573D82C9EBCA39088AC645875AE1A723F3834A2707597B3C193778F29349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049178, "uuid": "e9a32255-cb12-4f00-95fb-f4f3e1134ee6", "value": "6144:ZzM6kXMrxiCx6SdDAhkBJbhIjBjq+4YbQ3E/lvMp5gpjmaQ:ZLrV6SdDB4Llc0/lvwgpjmaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049178, "uuid": "cfec9856-44ef-45d1-bc40-6707b4cf1f48", "value": 361652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049178, "uuid": "a4baefa6-5ee4-4da8-b55b-546cac86c3b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049178, "uuid": "884eff63-edde-4207-b318-264a20348d1c", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b320e2e6-d247-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764986583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986583, "uuid": "bd25c880-1eda-48a0-8466-ecdabd8de453", "comment": "Malware payload", "value": "e061ffab6da85fb45399fefc0c0000ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986583, "uuid": "35e92ef1-24e6-4a7b-9974-c541156c943d", "comment": "Malware payload", "value": "15f8caaa335d88b23be5a6d331438bee9535655c807ba7030f05892eb8187884", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986583, "uuid": "1b32775b-5fc2-4af6-a593-27bba51a709f", "comment": "Malware payload", "value": "24dd528330e5e40f4d3acd0e2c941e70e5622d41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986583, "uuid": "d2aa478a-daf6-4b26-9864-d4d1604c96ab", "comment": "Malware payload", "value": "003d1f593ce60f252ee4853061d87a379aadd414e6de8cb677a50bbc217964c53712eec5fce4922bb032847558cf6b69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986583, "uuid": "0eef258e-e01c-4051-a385-24eae487f608", "value": "T18EE17117E2E2CD32D8D4137E45930A1A223DC8659E83DF132E0C896D2E537DCBA72B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986583, "uuid": "964d8ebf-24fe-4bf2-b9cd-674d6990dcf5", "value": "96:f6u6TiUBOUw3IJheuhiX5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcbYJhApZz/cl+M2x/fLbpziQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764986583, "uuid": "3cbbd803-c86d-4d71-ac6b-a85de894b87f", "value": 6968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764986583, "uuid": "5c16c019-8ee9-4973-9af4-256ec4039598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986583, "uuid": "10d4664e-d56e-439d-9572-eb490bcdc45f", "value": "linux_i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3879d05-d297-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765020917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020917, "uuid": "04ec3bc1-220a-4f37-8a85-c932e48095ce", "comment": "Malware payload (Mirai)", "value": "11f3f96fb24d2343cd9efd7e691756ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020917, "uuid": "0a19e65b-cec6-47df-8030-450b3690824d", "comment": "Malware payload (Mirai)", "value": "15fdff289cf4245a8d20b6e21b15ad1ba2a4466834f3de949e932be8284eb08a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020917, "uuid": "ef104a6b-380f-483b-b7f0-184448856588", "comment": "Malware payload (Mirai)", "value": "f9463c359347a235d2327be6dd02d0531dbd5374", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020917, "uuid": "6aa1e3e7-b453-438d-84f0-8ff651591560", "comment": "Malware payload (Mirai)", "value": "f404cbcf80ac1baf2108a9644856c06c23bed9c68b741ae2357fbf4c8292c4fc80576d4cbe1a59a157e827385eda016d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020917, "uuid": "6e9226bf-8c87-40a2-8b42-6db7f3e477f9", "value": "T1DB731982F8828B2AD6D0137AE77E618E3361A3E5D2DF7117DD205B227B8110F1D67E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020917, "uuid": "0c43a4f9-895e-4714-9829-8deb1514f6b2", "value": "1536:FbRvqvPTyOQ6FoXw1Tbep4v+CsWeXYFx6xmk:ZRvqvPTm+xWqFlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765020917, "uuid": "75e4ca88-6c5f-4805-b6dd-ab13190039d5", "value": 80328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765020917, "uuid": "989b23e4-6611-4cd0-b4f9-a488c4926d58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020917, "uuid": "09f53039-3a00-46b2-a519-a94a35ed5805", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7512cea1-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049186, "uuid": "5aca45de-c3d8-456e-bb9b-9f600be23d7e", "comment": "Malware payload (Mirai)", "value": "8a06d68d19a3a9aebeb907b4c2564c43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049186, "uuid": "b51d2979-7e14-4298-9cc6-9110a10f4d47", "comment": "Malware payload (Mirai)", "value": "16258383a4e5e2d186076e18433189e0576df269c7ab17f5f8f1c30bb86f62a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049186, "uuid": "a9b79ba5-909d-4ad4-b55b-5e30c7e07fd2", "comment": "Malware payload (Mirai)", "value": "55bfc60dbd9a69669c4488ccd3852ed1899dc974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049186, "uuid": "ef994e22-9076-47e9-865b-85becd6bb134", "comment": "Malware payload (Mirai)", "value": "ed4561aeefb1b31524b46c89c1d4e8bd4bf2999dba52dd7e116ab4053325e8c5767adf2b8099ac1e16f1dbdf082c00d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049186, "uuid": "15e41692-6785-44f5-be0d-db59c4deecea", "value": "T14E74E046F7573D82C9EBCA39088AC645875AE1A723F3834A2707597B3C193778F29349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049186, "uuid": "0133eaad-0f8e-4161-b8ab-0d4bd54afce3", "value": "6144:zzM6kXMrxiCx6SdDAhkBJbhIjBjq+4YbQ3E/lvMpjgpjmaQ:zLrV6SdDB4Llc0/lvugpjmaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049186, "uuid": "d8a8735d-2538-4a0e-b89b-784deb438a7c", "value": 361704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049186, "uuid": "8d0c7218-3dcd-4638-a48f-93ebb5dc6fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049186, "uuid": "616377ab-35fa-4fc8-b977-0d85f425b7c0", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0409bce6-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042124, "uuid": "698fcad5-b912-4e34-830d-1d6013e10827", "comment": "Malware payload", "value": "5884b64f66c2297be1d3dd219b62dc58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042124, "uuid": "822ed928-7da6-4429-bcea-e626b495e63b", "comment": "Malware payload", "value": "172258e53b9506a7671deab25d2ad360cd833a4942609f1a4836d305ffe4578b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042124, "uuid": "d3773ac4-beb1-431b-a29d-3c5f97034964", "comment": "Malware payload", "value": "5d00a9100c88ee1a6cba658c3a9a02305a4aef2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042124, "uuid": "2776183b-fecc-45ad-a18b-2712f23456df", "comment": "Malware payload", "value": "67d0ae351ca1fa70c0dc3f50eb77b9fccf16ddc369702184884e90a274d3c72d10828ffa331c231751aefac66dde2fa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042124, "uuid": "e1539a37-9bc4-4715-9bd5-01a3e6c74270", "value": "T1AFF332212DEB109DF3A7ABB16FD8B8FF88AAE5B3651D71F5204147464B21E80CC52B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042124, "uuid": "4115c352-6762-4ec5-9391-ad227b7fca73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042124, "uuid": "067f2884-7cea-4b8e-bff1-dce4073cb3cb", "value": "3072:z1YwZyb6o9+zNg+sRzk6lRjbTs7Ng+sRzk6lRjbb:5zg9bfhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042124, "uuid": "228821fe-ec77-4ea7-882e-49741e6400c7", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042124, "uuid": "c308a538-3341-4f8e-a571-6722760325b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042124, "uuid": "83057f85-2667-43af-8dd3-5902001d4800", "value": "FleetAgentAdvanced.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75491ce1-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050045, "uuid": "485acb25-97e2-4238-b8c9-eb853679ee6c", "comment": "Malware payload (Mirai)", "value": "461581528d027a627dd374aa54f53319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050045, "uuid": "bc1406e5-e7ca-4fbf-8e66-11c974cc5395", "comment": "Malware payload (Mirai)", "value": "1735716a2d040292b4eb9a50d2b1c55b260da4b0e53e4ac39b24a90f5d521e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050045, "uuid": "8fe13891-78c4-4ba9-a3c4-562722e15957", "comment": "Malware payload (Mirai)", "value": "bd5ee153760f1da75144eda216cb9456d9742259", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050045, "uuid": "a7e84d0c-13c0-4f41-b5a4-1296311a11cc", "comment": "Malware payload (Mirai)", "value": "887e3daf949d258c7f3fbf64383cb2f6f73be8e28ae33ec548e9077fc391a3c9d151ba6a758f4ca3ae7a7d18807c9ca5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050045, "uuid": "3ee2d109-eb86-495c-ad91-06a1625d8774", "value": "T1CF935B22F979193BC8C4A87661F34321F2F6438B24BC9A1E7DB20D8DAF6465022577F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050045, "uuid": "8a891b1d-de32-496d-89b4-65d3f9d75170", "value": "1536:jUwkLn6oHcD5npOt81aQhiBxEVLMqtx9Tq5je6wrpyt0S7Y:NKgOgP79T6j93Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050045, "uuid": "3365ef59-fa69-4bc7-9d57-c6a498dd2d85", "value": 95072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050045, "uuid": "0c464fea-5954-45fb-90f4-85d8b57638e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050045, "uuid": "78747d45-f8f6-4039-9d20-4b01f0944270", "value": "nwfaiehg4ewijfgriehgirehaughrarg.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d6e0b9-d2e8-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765055843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055843, "uuid": "64d6031e-4666-4c54-b3d1-35e6b4d6137f", "comment": "Malware payload (AsyncRAT)", "value": "a451b5ac5e118e8a64911aa1f28081e0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "CorujaTutorais", "colour": "#D5A5B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055843, "uuid": "d5ad81cd-b8c0-42a8-b74b-6e0a727cfb63", "comment": "Malware payload (AsyncRAT)", "value": "17da6355391d2599bef02a84a652b45929231bb36f7fb349d40dbf70d42dcc58", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "CorujaTutorais", "colour": "#D5A5B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055843, "uuid": "42bd8e96-dd3e-4e54-84bc-668960cb1cf7", "comment": "Malware payload (AsyncRAT)", "value": "f432c302ebfd1eb65996327d2eaa474edbc4b6fc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "CorujaTutorais", "colour": "#D5A5B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055843, "uuid": "9c2dc80d-68b8-4902-8f20-c2e70defe7fa", "comment": "Malware payload (AsyncRAT)", "value": "49e219b1ef450564140a4fb19e802f0aca1e22a1ebe584d0f3fcd58e4f85492c4335f180723f8ebdbfcd3d7ea76f5ef4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "CorujaTutorais", "colour": "#D5A5B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055843, "uuid": "77e82c99-2597-408b-bb79-085e9743b9c0", "value": "T125234B087BD08621E6FEABB51972B6060671E6078D13E75E08E483DF1F27681CE917A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055843, "uuid": "d5069ccf-3f95-4fc6-9af2-28dbcd4729b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055843, "uuid": "e99dfdf3-c4bc-495d-bd83-d028492a7203", "value": "768:c/rxgvGl29Jv5JiTGGo1TcMc1ElYztQiVZl9wbFEPr9pK8W6iOChFzjug8:cziC2OqIpalYzFtGFM9o8W6iOCHf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765055843, "uuid": "0ccef6ee-ab2a-4704-b31d-fa92599c3d1d", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765055843, "uuid": "a3158c56-d71d-4e59-97bd-3ad4bdf00cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055843, "uuid": "a9cb1a28-b5c3-42a8-ae2a-c0d6c69e2db3", "value": "System32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67897ddb-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042291, "uuid": "f4810efc-98b8-4545-ab84-800caee6fc03", "comment": "Malware payload", "value": "36191c81f6b9fa40dceaa4700ff86800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042291, "uuid": "ad6c783e-6035-4507-bcf9-98b522dd55cc", "comment": "Malware payload", "value": "18da271868c434494a68937fa12cb302d37b14849c4c0fc1db4007ac13c5b760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042291, "uuid": "fffe51e3-ac43-4768-8763-66bdc6e3d582", "comment": "Malware payload", "value": "08feb675d0553f98007c52b7658a725dee22d696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042291, "uuid": "66247d81-d307-4ba4-be34-9845c1d166cb", "comment": "Malware payload", "value": "c9549185fc0e9636848b0148307646bae5531ec0d18dc23591c1390bb8ca3c3bc84ff47a7381db99e5418281e682d73e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042291, "uuid": "7d15ece9-22a8-47b5-a640-f2345f13ef8c", "value": "T1C7546B17B2A155ACD55AC078931B9773BA32BC8A16207D7F13E496303F67E112F2CB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042291, "uuid": "b62df8b6-f100-44e3-846c-3b1d8f44bc0a", "value": "5dae67fbd9020e9fab36f9a4072339b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042291, "uuid": "a770839d-f860-42e4-9ef4-0dbda1657078", "value": "6144:eRBVSC3Hqbf+daKfk+SYR+L2c7oFSgxXCkPzpiKGKO+Bf:G/XBs2cUFBxyk1O+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042291, "uuid": "043cc174-8b12-490a-84fe-dfc6badd91c8", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042291, "uuid": "e94917c4-640f-44ac-994d-749a6b28eff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042291, "uuid": "e8286b12-6634-4a3b-b22d-3f7c3c886980", "value": "uac_test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c1543d-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037639, "uuid": "b1881a68-f87a-44ea-b32c-20165cbfcfdd", "comment": "Malware payload", "value": "204e8d23fd24b0898e8076fbf3e6523a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037639, "uuid": "ab4259d4-a7b1-4728-be51-bc61754a8e10", "comment": "Malware payload", "value": "19c2967a309c02ea08ac9e098b6f53675fd100c9c4cb87d4a6f412703bef071b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037639, "uuid": "44927356-f7f2-4d93-a5ee-ee591febeb7f", "comment": "Malware payload", "value": "1c6c7bee581802b61efad7f73235faa6d201cbd5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037639, "uuid": "a94b160b-1d59-466e-b871-6619cd14f94c", "comment": "Malware payload", "value": "43015009bf6ae4af55af7c08b23c945f6becea25d606e7f18fb570a6f9bd1c2f049b64e8af5125b69baa5accc77f830f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037639, "uuid": "b672dc53-307a-4a68-a681-3d0baa3a1743", "value": "T1048533BAFFB4C45E933AC76B6D4E4AF33A723F9D50A9C0C854A0D7C944C557B284A842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037639, "uuid": "0fd9e315-8081-49b4-b5a1-4ad01f440bab", "value": "24576:DdLSD5ohUp9I2XZ5gRSE0OW5jL92yi1wcHEtY9EzQTjtSLBbHw:x7gD5YSEQ5E1Uiuz65SLBbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037639, "uuid": "b74bcd01-4f1d-4bbb-9a15-331e14e9e825", "value": 1731665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037639, "uuid": "94c3cdbc-6fda-4f42-8158-f40898a50ad4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037639, "uuid": "9b337ea9-0f24-49e0-af29-795863e7768b", "value": "aria2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8bfa93-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049175, "uuid": "a68a4d4c-9573-41d6-86a5-fafdad8a7f74", "comment": "Malware payload (Gafgyt)", "value": "f84634e1d263bcfde1e82ff7f9fb47e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049175, "uuid": "f07319c4-a32d-47fb-9d3a-7c8555508a1c", "comment": "Malware payload (Gafgyt)", "value": "19c840622d92b3183641974a87ddb0d25129c8b017b354d591b1bd3fde1b0f31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049175, "uuid": "857154ff-a601-4fc1-b795-b7c3ef470b6f", "comment": "Malware payload (Gafgyt)", "value": "4c3a9a9c269c567235bf3656aaa16103d67ce818", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049175, "uuid": "5da90070-3448-46ec-949a-309a3ebb601c", "comment": "Malware payload (Gafgyt)", "value": "2c83a4e97585f65803d6d5449193f55c75e0098e502b850030f82c2ae60d3057fc66ad9408c26af57712b1bb72d3bd66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049175, "uuid": "d8386cab-2319-4c43-8bc1-974b856c4a00", "value": "T146A32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17982E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049175, "uuid": "c9573031-167e-4344-8b3a-968621831e43", "value": "3072:h8700G8jMeJkxOD3P4KhlKmZuqQ4DPwXXtse:mG8QeJ4OD3PrKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049175, "uuid": "7c33c0b9-e33b-4a64-b903-4ea16c17ae93", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049175, "uuid": "e141ab57-9600-4725-b79c-6030367c5e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049175, "uuid": "8e34fa37-88f9-4fb3-9842-466c1c9120a4", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607998cc-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037555, "uuid": "e48b40fd-e01d-4a88-a553-61f9afa7ed84", "comment": "Malware payload", "value": "78cc2ab4088c0e67855928b1a0225a4a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037555, "uuid": "d04d530e-e4af-40ae-bbfb-3209c0c7dc14", "comment": "Malware payload", "value": "19d63fdb85e7714f0e6c484ab6fea656913b9cb3d88d34c6fefa1b90e00f9156", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037555, "uuid": "6ec0cecd-4f26-4723-8b72-b8e7de06b84a", "comment": "Malware payload", "value": "546db22f4a8f4aede7b30a39302417137dd0f8bc", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037555, "uuid": "3f6c097d-3f08-4915-a95e-c876cb1233d5", "comment": "Malware payload", "value": "850748da7e633ecf2cc51b53a6aef3e72e90cc33f8a4d6e0c297945ba0278e479485d0c4cf48cf01287e0e6891e137e2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037555, "uuid": "abe2c61e-7b33-4852-8b5a-7ebc6a4e53a1", "value": "T1DC6733EE0C18BA7EE8799D7293B1B7F650BF5C8A954D6203B1B6B402147F0768013BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037555, "uuid": "9a4b75ed-ac63-4b68-9ae9-6a19ae30e30b", "value": "786432:+8yKs9cwlk+o8ct4rwKInuav9G9cbqHpLFFHHoRhuHegbW:3ls9cwlk+o8S4rwXnuavuc+tFM4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037555, "uuid": "8f5b51e9-44ab-4b6b-a6c7-bf8bf68f4f45", "value": 32630218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037555, "uuid": "bd3be669-c050-4343-aab3-e1f9f0217af7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037555, "uuid": "3fb13fba-ddc1-4d62-a875-5f6a6f3d8c39", "value": "IObit Driver Booster 13.1.0.171 RePack(Portable).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b707761-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061249, "uuid": "b452acc8-aa7b-4919-bbb2-1fa440adbb89", "comment": "Malware payload (Mirai)", "value": "56e950bc15a89bfb3fd91d8995793775", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061249, "uuid": "1aff804f-c6ed-457a-b053-106def9b99c6", "comment": "Malware payload (Mirai)", "value": "1a9249100df07b063c3efcf853494ba4b7dcb496fba25ee1b091c16d1d73ca8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061249, "uuid": "5ad1d4b5-645f-44c3-a279-6a095d8facc8", "comment": "Malware payload (Mirai)", "value": "1f464c090f29d3a635335557114be934e0445aea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061249, "uuid": "d56291f1-336a-46db-a1fa-97264c1128e0", "comment": "Malware payload (Mirai)", "value": "4be3599113b37e1459299108e7ffb3bc9cee4321a6d5419801aaa8a8de59aafc4dd4e965aa709879461add69d03d7cae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061249, "uuid": "e0b89b2e-85ab-4ecf-bfa5-a5cf782ec22f", "value": "T10D93C81E6E219FBDF75D823047B78A21A79833C637E1D685E25CD6005E6034E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061249, "uuid": "9e0edd46-f7ee-44e7-96be-e0d9af09c3d8", "value": "1536:j/eRRois6yruk9zgg0CrIbIsUKV/eLuuVmwYSE:6RRjs6yr/dgCr0IspAmhSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061249, "uuid": "0b820b7c-ae05-4f24-86c8-69734da46d5a", "value": 93516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061249, "uuid": "a3b1719c-4939-4df8-ae8a-dee1120a49ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061249, "uuid": "d0f339aa-f0fb-4e33-ba3c-9cf06d100cec", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01111d1-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048936, "uuid": "65617cb5-2e00-4f96-93ad-fb99eb4ab59b", "comment": "Malware payload (Mirai)", "value": "952a6f9ff5a7372b879adfbf1166e73e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048936, "uuid": "35d3be91-2767-4a05-a979-2b6ec5bb93fe", "comment": "Malware payload (Mirai)", "value": "1ad55e88b645a8d7881e20bdc7a523f7a4e6200c1f41b23770a680975566d965", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048936, "uuid": "cad2f52a-8371-44fe-9f9b-6d7ba08af5c9", "comment": "Malware payload (Mirai)", "value": "0be6666538a287d451f03fc00b05d935e1d85b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048936, "uuid": "bb77c1fb-607d-4268-b96d-debd03e91919", "comment": "Malware payload (Mirai)", "value": "e361335db916716f668759ce6c38248701b2f7332dbca4a43f47b836c947d92d84dfcf659502d6ada0f08f32dfe39281", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048936, "uuid": "3a8f0e68-3247-4bd7-867d-40c2a1f12b78", "value": "T1A7343B45EA418A13C4D117BAF5AF418A3332A794D3DF730699286FB43B877AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048936, "uuid": "585c6736-d97a-4868-8354-d0327b7f550d", "value": "6144:LYoHI9S/OBzabKacEK1dAnJd7ZHf9ihM/9hAU:LbES2BzabKacE62J3YG/rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048936, "uuid": "a32e8206-3416-4301-929d-a67a7fbb7444", "value": 230960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048936, "uuid": "ba486df8-b4ca-4b0d-9771-3c1628384229", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048936, "uuid": "dfc2e2b8-ee0b-43ad-905b-b9d11fd3d56f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3280b3d9-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042202, "uuid": "775ee149-2d9c-4107-b7e3-90e3fad9eca3", "comment": "Malware payload", "value": "c0055d15b6a539fc57880642e8d0eb27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042202, "uuid": "c99518c3-f35a-4dc9-8b58-0acf8407e06b", "comment": "Malware payload", "value": "1b5d23c3b3a12bfff4b8b2f1f1e3c057b31c7b9a1c9252ac5f61d16ef93dee39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042202, "uuid": "e12ed52c-c5f4-4033-ac3c-7c2432c64f50", "comment": "Malware payload", "value": "d54d7346b98567d26407f01855b378f49c128021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042202, "uuid": "1643db20-b80d-4b97-94ea-8839f6a855aa", "comment": "Malware payload", "value": "a6e62f015c9e371404425ad0ed43308de317f73bef355c10ab247905da38a6c045c13be178b59cd1b52caa429d7c1397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042202, "uuid": "ca89fa82-1f22-4f67-85de-97e06889fe0e", "value": "T16DF6F8E85DC858A1D257F83975997EF411323197EADB1E90C3BCF9610D7EAB2AE0090C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042202, "uuid": "1e26043e-26f1-403b-8f61-533ab0b2b726", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042202, "uuid": "0a2ecd21-0139-4e23-9a74-2b05bfc1af5b", "value": "49152:YE7n1C+6LNMG6GSyZReZfebI6V8+kWUM:YE7n86GSyjICka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042202, "uuid": "6279fa8c-dd7e-4b67-8fa0-08ad4b96249c", "value": 15563776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042202, "uuid": "6edc5795-98df-4535-a5f4-d8ec5df955fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042202, "uuid": "1bea8ff8-bcc9-47d5-9fe9-2ab7a1de1bf5", "value": "enc_gui.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8250300a-d292-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765018714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018714, "uuid": "e636d0ea-71f7-4df9-80c0-36ff753d48b9", "comment": "Malware payload", "value": "002c154fb33819b8870304a6cd4b087d", "object_relation": "md5", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018714, "uuid": "59a15346-a6a0-41c6-8814-f19fd64ff7ba", "comment": "Malware payload", "value": "1b66fe546bbde8c769fed8fcb97266c59b4c59c2efd749a2d62852480b9cf3fb", "object_relation": "sha256", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018714, "uuid": "b68a26dc-3ebd-435d-95e4-97b3b70f1418", "comment": "Malware payload", "value": "46e12d26e12375a66bcce01e12033087dc2dae2a", "object_relation": "sha1", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018714, "uuid": "9f38e729-8b53-43dd-9975-c9894d556405", "comment": "Malware payload", "value": "cc7a5782c9b7115545db012dc2286e1ad833426a78c1407690f6ab6cb7bd843118658cd611355a8069f69c4718a9c358", "object_relation": "sha3-384", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018714, "uuid": "ac4f90e2-678b-4f38-9a6f-dbe80af61196", "value": "T1ECE28C7E75362CDCEE3DC32BD1AC3349C460DDA7F2591AA254AC1E951F08A85ECD8358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018714, "uuid": "706f9d7e-d2c1-44e9-856f-ef8e724d0173", "value": "768:C386pqEhbCZovZkMvaByZnppfYTbMHzrSoKM:I8FroviOaB8pA/OzrS/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765018714, "uuid": "af7a6e10-1cab-411c-bdb7-51ab897eafff", "value": 31465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765018714, "uuid": "46b282c3-53d8-44dc-8f3c-6508d729d2ad", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018714, "uuid": "9eee8f6a-f143-4ab1-9d9d-c1aa02e50ac3", "value": "tmpED1D.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d43c06-d25c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764995367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995367, "uuid": "613b4a9e-0265-4c3a-a805-c94cb634536b", "comment": "Malware payload (Mirai)", "value": "81c540c97a853ce228d4ad210ddc021d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995367, "uuid": "5e665c39-ec30-41c8-a165-710bb7749cef", "comment": "Malware payload (Mirai)", "value": "1b6d727a8b15adecd8951795939f75e12a65d9cb3a344b96d4aab87cbdd625f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995367, "uuid": "e416afbb-daf0-419f-b650-089af16d302b", "comment": "Malware payload (Mirai)", "value": "0743f7108c029305c67f3012e80dfbefada2b458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995367, "uuid": "7bf77dbf-5d1d-487c-a9ac-801d8c8eeb76", "comment": "Malware payload (Mirai)", "value": "ba67e0cb8ab703168376f0b76773e81bdac3403dec61406d1d9f588c8f3b325b37c3d28dcde2d5c2da67904ed81cb61b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995367, "uuid": "8be3dce0-ca22-4001-8441-fab58c5a8223", "value": "T111936CC5F643D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA2511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995367, "uuid": "e55cf934-accd-4f0c-bfc7-a2945113645e", "value": "1536:xpmWc2AcighsZ82fJxfczHD1mSsM8meUigBQ9TnkISGtAd/0xZ:xpmX2riED2frfcHhmLVUBQ9kVT/0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764995367, "uuid": "5c91ea57-e52d-4e13-8a22-068b716e3769", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764995367, "uuid": "aa429c64-918f-43c9-abc4-64370fa3cdc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995367, "uuid": "f672faa6-2018-4510-9322-b6ce4d21ab34", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c121c3b-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006114, "uuid": "8bcca111-308f-44d2-907f-00c3bc4e617c", "comment": "Malware payload (Mirai)", "value": "fe48afb1a33a2eeafc2ba47231574233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006114, "uuid": "1ccbb7be-7a67-46a1-8a2e-bb5a68b92d16", "comment": "Malware payload (Mirai)", "value": "1d4d24c9fc8553770036239bc2be91e1865a5ec6ec8316cb0380117a42380329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006114, "uuid": "dc8bee33-f7e7-40e1-a2e3-65693acf19fd", "comment": "Malware payload (Mirai)", "value": "10f9c84411e94402ba1c4771af248b6f16c74ce9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006114, "uuid": "f52f70cc-b537-427d-89eb-4f4dc3e4c447", "comment": "Malware payload (Mirai)", "value": "26de556048cf87c5e7d5a59c3c5c97bcb1d264571ba387c02298fdd3056fd0218e9543b165e6c76b925b5c4f031b77d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006114, "uuid": "2521226b-fb67-4c9e-933d-31b55d3f4e40", "value": "T1730482867FA03FFFD81ECC3602D59B0A129C590962A9BF7B6A64D404F64B10E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006114, "uuid": "211577ad-b12b-4ad9-a467-9f239c88ab22", "value": "1536:3tK7v45ZG2s7V0aRzOp1axoQ0iIG1qeWGIpHbFlbDr2r18B7sRbwhsElTPFILrsC:c7v4nG22Vl5Op1zBG4bSiB7cQF2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006114, "uuid": "1e3caf29-77d3-4eb0-8820-d6c9eee3b7ec", "value": 175400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006114, "uuid": "e4bff04a-a1c9-43e4-914d-166e174fe9cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006114, "uuid": "f6077f87-c899-46a3-a77b-838c178b76cf", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fa273d-d2de-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765051170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765051170, "uuid": "08f2a6f4-c2d7-412d-bda1-ba01da5bb6a7", "comment": "Malware payload", "value": "8074ff2fb0f5487f831aedd47ab99f1c", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765051170, "uuid": "91ea19e7-7e70-4584-baff-47096cecf12f", "comment": "Malware payload", "value": "1e62f8362665ea67ead0cef288fe6e70a3f9ce5493abffabe52ea2f514bfc12e", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765051170, "uuid": "ec053f83-160b-40ad-a4cf-b1fffdc61731", "comment": "Malware payload", "value": "56129bfe701a573ecde46981b07fdfc20d006712", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765051170, "uuid": "66adda39-5f52-4283-89b0-767c710f8ced", "comment": "Malware payload", "value": "022db42750fc8df55b6e54d062088f3cb040cd4309ae89921ad970f116cc8c4cf603eed62eafbd3723b4c3b48147258e", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765051170, "uuid": "58e3a674-78b7-4605-a4a4-34cb6a9912cd", "value": "T142145C4677A400F8E5779234CD524A06F7B2B8160761AADF03A047BAEF236D19D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765051170, "uuid": "532f0fc3-bc64-493e-bb85-b47fb92de97b", "value": "812eae99962b33a6edb43b62f6744257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765051170, "uuid": "59545cd2-70d2-4a3e-a8e8-488ad4ea2afe", "value": "3072:xBfTkrD1dfu7jIlgFaxNXX0FLagYStL2HvyCmgJ6Xpa:xqm7jIgcNHRgNLls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765051170, "uuid": "1a48e1bf-a32f-4c09-a868-e5b0173b55b1", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765051170, "uuid": "c7f600df-8a16-43fc-887d-8d2e9052d5c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765051170, "uuid": "64f6992c-fd6f-4774-892d-da7aba773370", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6b20ba-d2f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765060714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060714, "uuid": "e91ca59e-82a0-41b1-bae4-556bd01d2a45", "comment": "Malware payload (Mirai)", "value": "7176708c48891ce91b1b3ad36416f431", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060714, "uuid": "2209bc73-d323-4c97-b5d2-50ab2c0a2b0d", "comment": "Malware payload (Mirai)", "value": "1e6a8da78e09cc2ea9f5a57ba3589a9301feeddaf90d2c50d4756aa28322f42e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060714, "uuid": "a118d0b5-14da-42d1-9b45-87c7bc80e6cf", "comment": "Malware payload (Mirai)", "value": "da630be7ef69906db711fa3e5603a73484ac8729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060714, "uuid": "3e687663-edbe-4459-8b6c-e110a9e0dd09", "comment": "Malware payload (Mirai)", "value": "c0ffbe34569be373515063d2147498ab28837c0980628ef097036ea6f2673eece89790d070cdb6d2cc1378034c2d6108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060714, "uuid": "d3a5c9ec-cfe1-41ec-997d-c5375061d296", "value": "T158633996FC01ED7DF81AD77B4853080AB671F3A101930F3667A7B9A7BC721A84962E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060714, "uuid": "9acfd305-cd72-4529-8b80-6e4554c2e053", "value": "1536:oPecFc79Z7YZ03bHub8spyAm5Uy3SPo5JAQb6CbcVW6ZyPZq:oPecOYirHulyAm575CQ2pAPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765060714, "uuid": "b068e78b-bc1a-4de2-a1ce-334af789a345", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765060714, "uuid": "4851e8e6-03d0-4e70-9c71-7203ec45580f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060714, "uuid": "3c044f76-25fc-469b-9663-cf2061b5b374", "value": "fent.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384f4cd9-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003128, "uuid": "1cbddee7-4c71-4135-93c8-55f64f33dc43", "comment": "Malware payload (Mirai)", "value": "be809e95e30cf1f08ea35fdacc8ee418", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003128, "uuid": "b0a9faba-1499-491b-882f-1783b53fe61f", "comment": "Malware payload (Mirai)", "value": "1fa305b5646b159d7af886c8bffb8da00076f9487991c2ceec382fd7c81cc208", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003128, "uuid": "346201ae-0200-4765-bb7a-c0dc0b87c3cd", "comment": "Malware payload (Mirai)", "value": "9e9a4e547511077bda762a6ffe7511fa35aa0f5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003128, "uuid": "225e0ad2-09f6-46a5-9bf9-aaf206e1303c", "comment": "Malware payload (Mirai)", "value": "b4a4f2cb9db8eb0183c96b7a57b3b956ed8bcab6f77cb0d51ef2baeb1ebff01933dde6fdda7d3c9f677448f0ddc25f5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003128, "uuid": "e0ab420c-2043-4f44-a187-5d2070556f32", "value": "T130934ADAB400DE7EF84FE6BA4C534B08A171F3711A430F369BA7BD67A9250543E4AD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003128, "uuid": "9ff3e20c-3fcb-4712-9d3e-b0b9f08bcc3c", "value": "1536:3rhWdtH22A8bTEQGQmSFCi4/z69V/UphmWx8f+WQeuacWjcW0JcWcBWhQvNbX5bG:3rgH22/jGe+tdWQeuacWjcW0JcWcBCQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003128, "uuid": "76044996-68f6-4b13-a9b1-88638b48c52e", "value": 91396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003128, "uuid": "56082c5e-0225-48eb-86d1-8e05ec9b20e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003128, "uuid": "5fdb1e58-2096-460e-8eb5-c248bb985ec2", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7699d4c8-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050047, "uuid": "8846789b-526f-4ab7-998d-966c99ebc9d3", "comment": "Malware payload (Mirai)", "value": "25c4e84bdc18dc27e49afbe1efead694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050047, "uuid": "efc7a157-cf4f-4236-a044-5e264a18f9f5", "comment": "Malware payload (Mirai)", "value": "1fe6e046f9aeef0f006d2fe497b2dd85085f966764e981e83cb22f55cf97df4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050047, "uuid": "f40bc979-d094-4668-8694-5ff8c5ca7ab1", "comment": "Malware payload (Mirai)", "value": "6ee291a05795c944252c26c110fdac4465926702", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050047, "uuid": "195c0bc7-9c4c-428e-b6c7-637a93474b25", "comment": "Malware payload (Mirai)", "value": "683a9e164f9b9adf3466e6200156b4e0150dabfb270474e9933547e44ca86d6ea0a788cf1606dae9613e4d02d19574dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050047, "uuid": "b78a745f-3461-4f8d-bbc0-a8707208a136", "value": "T19103E170C6E30581EFBE68712CA5C3C13366094A5675DFE0A6B4FF111E22F6774259C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050047, "uuid": "a5ee07fb-27b6-4771-b7aa-2179678a6388", "value": "768:0/O6+gxrsRrDE3OaH/abgdfH9OGaYzvLZk+7FWUe+sIqk24zfTm4uVcqgw0I6:0agJErDVaH62fdO/YXO+7FEtIqZifTme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050047, "uuid": "0aef52f2-7c42-45be-b95a-73c0c67e7995", "value": 39976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050047, "uuid": "7c14e95d-3427-4fce-8348-1101a87eded7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050047, "uuid": "54a527d1-d275-4dc7-a3dc-fcfe5918765c", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dff891-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061205, "uuid": "301ae0f5-9315-408b-8b2f-3d7e3eec60b3", "comment": "Malware payload (Mirai)", "value": "b164cefd676344c0b568609ff5d9ede3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061205, "uuid": "f051cf4f-ef1a-404f-90cc-5f68d976f922", "comment": "Malware payload (Mirai)", "value": "2110ac3ba62dacb2cef11e45729af627d7d938e58fd120831b17071e250bd990", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061205, "uuid": "fcf863a3-a0df-451f-820a-85371786bf6a", "comment": "Malware payload (Mirai)", "value": "59d8e475d1bbbd1ae6e8208f081def67849a2dab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061205, "uuid": "81cf0bc4-c991-4731-8d58-b0f08c95c6a7", "comment": "Malware payload (Mirai)", "value": "7515ba94cef07a6d5677b0393c8ced4b49dca44c2b51d143d1e71f88cf9c9a3a8197dfaf3b384f569465d7f52c1d64c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061205, "uuid": "6339571f-ae8e-4b8b-a8b1-83a07f7bf2a1", "value": "T1E0E2F1B66ACC2032DB2AC27A931F215DB24D5C5107C9E74B9D8C656BC4793BC427B9F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061205, "uuid": "ffb10973-dd98-4b05-8246-b111bc1134fe", "value": "768:5LmJ3/UoNwv2WMd7BHEgv/YoqG4UTemxj:5mJVNrHEU/MjUTemh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061205, "uuid": "3db1d644-9caa-4dea-a7ea-8fd99e4faa1d", "value": 32540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061205, "uuid": "beb09720-01ee-49cb-a0fc-0f0babd74c37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061205, "uuid": "b61b1c68-1a03-4e78-b269-db269f06acb1", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd71eb1-d2b7-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765034708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034708, "uuid": "1676eefc-ce17-48ff-93bb-acf6a9f9de54", "comment": "Malware payload (XWorm)", "value": "1d91e12eb8c520f2ed0bdc42c9904042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034708, "uuid": "0bc26b32-628b-4e4c-8ee7-254b17e5bbc8", "comment": "Malware payload (XWorm)", "value": "21697ef58764487b80eb727390855bcdaee343058e08d2e38bae2a67b1bd145b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034708, "uuid": "d7caa787-421f-4b65-8dbc-3def4847bc79", "comment": "Malware payload (XWorm)", "value": "b49db294efb8fc572bdf51146936a5fc2c5eefa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034708, "uuid": "05d4bcda-8bff-440c-9ca7-a7a49a6ec5a8", "comment": "Malware payload (XWorm)", "value": "43125c19c629fdd53634ac4b7eb9bd676536ffc1f60604292c753ce0ad5bec712799b0a1235820063160bd6ced924027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034708, "uuid": "ee8ae64d-d414-4eb9-8ed0-66b6e127444d", "value": "T12C259D027391C062FFAB92734F5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034708, "uuid": "9460d964-dde9-4c9b-9fce-6fb6ffcc4a02", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034708, "uuid": "b4c4ee28-8898-4a65-b2f5-71571b9a860e", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1ijXda8DTUW:WPVt/LZeJbInQRa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765034708, "uuid": "c3338192-9353-4167-8b38-ae9431244aa5", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765034708, "uuid": "2c066d8b-3d6e-471c-873c-da9561559f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034708, "uuid": "4163a9a9-71ee-463e-a2c9-c57e0a6cc9c4", "value": "1D91E12EB8C520F2ED0BDC42C9904042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57052633-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042263, "uuid": "de757088-140d-4e03-a343-f3038ca40bc4", "comment": "Malware payload", "value": "3ef5e34993c324dbd9520504ddeec8bd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042263, "uuid": "b3e1170b-1c8f-4bc9-a160-24a6d8d9701d", "comment": "Malware payload", "value": "216c3ea5d784bd15587809d664a5849ab32ebcafccd553598402c70cd21719ac", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042263, "uuid": "eb846b7d-7a53-41e2-aa4d-5b6ffa4d85e3", "comment": "Malware payload", "value": "49f9d03cd869bfff531bf438b5fa21e15579c467", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042263, "uuid": "411aa858-b991-4bc1-9716-c81649cd7017", "comment": "Malware payload", "value": "0c655215178c245e234e2c2e19385e24c10285504032e1897e24fb47b3fdd49f5b5958f4e426e164d0160e620f0c2d63", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042263, "uuid": "92161d06-511b-43dd-b7b2-840aaf4a66c8", "value": "T1D58423291CBA8B247CC51667FAE925C834DDB629DC7DEC94231A26CE7C14DCB041B27E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042263, "uuid": "06fb1b88-0d70-4137-b5e3-f28bc06943fc", "value": "6144:nnHHAWp5UkzU6elr3pgQ0yQLgVtIaaQVIVPOWJ+DxilasWh+bnOvlWo+/z0aui4:vo6e3OQgWSahaJJJo/h+bnKyz0a34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042263, "uuid": "4cf849f0-9740-42d8-bca9-dfcb757ab177", "value": 374665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042263, "uuid": "ac274a28-7733-4beb-8837-da54a4e3c3c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042263, "uuid": "07807334-f7e3-40c7-b76e-d1d272e95dfa", "value": "sideloading_agent.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d7e076-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043463, "uuid": "01caa47d-0e45-492a-9379-337ec7e6ab9d", "comment": "Malware payload (Mirai)", "value": "bca32cb4cb8d035f6b1237e52285607b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043463, "uuid": "b28c66d8-679d-462b-bf94-ba08505d62f4", "comment": "Malware payload (Mirai)", "value": "22941b4caec4169d45bb23767e4644b9b0161388c4e822d2ada9a1d7971ebc2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043463, "uuid": "984b1e9e-4bb1-4d16-b87c-91af85f7b0ec", "comment": "Malware payload (Mirai)", "value": "f401c459b4676abdc44a921318cdb50ce03169b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043463, "uuid": "8c3f314b-b206-4504-8900-c6ad728b128c", "comment": "Malware payload (Mirai)", "value": "e805c2c5ff8b765d593ce6eb746e94281b13a79664578be8e246cce699aa454a4bc8a2cfd62f8fcaf957f16f64c4b8c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043463, "uuid": "9d532ba0-5a66-447c-bd8d-067d1efaff69", "value": "T1F3E2F22046C95629EC5081B1B7AA668AFC2C3E04BD1EB3557F3940B3C7931E8A736D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043463, "uuid": "11eb40d3-316c-4a55-9ae7-502616823520", "value": "768:MBbVkTrCrl79LbeH/7BuCc2Hedxi2S636KKqFR+W:ApL9/2c2+W2DqKKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043463, "uuid": "eead380f-6d7e-4197-a10e-43207c3ee706", "value": 32276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043463, "uuid": "e00c7e78-a246-41c8-9bef-0f99c401ae1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043463, "uuid": "1616976f-4776-4bb8-a5c7-6e257e4a52e7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8010d7f0-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050063, "uuid": "dd33a548-8079-46be-af57-fa8e99eefcb3", "comment": "Malware payload (Mirai)", "value": "b4328c8a1261a5bfb59a5dc08638984a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050063, "uuid": "713f94ad-0899-482c-bc25-dc16e59d05bd", "comment": "Malware payload (Mirai)", "value": "233e3afe8173a71f015c77ba93c12df40d0831168fa14888717f2240ba1a43eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050063, "uuid": "b2db62b0-040f-4848-873c-2ed66e3e9881", "comment": "Malware payload (Mirai)", "value": "f2ca4b67a754577789a2b7583cac70c82464591e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050063, "uuid": "84fab048-900a-42ae-afbb-1e9915e2788c", "comment": "Malware payload (Mirai)", "value": "25c65fb5eada2ab69a2285a217ab9b44f58f6d8221ab01e7fdb4c0c648a4606458e986a95859381d25c7682cb0df8296", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050063, "uuid": "c0ead3bc-c342-41bd-976b-4184588198d2", "value": "T12E03E1AA51588777E1BE4038192B778F1835EC1EF550C71A9BD6F4A10C29F3F2714A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050063, "uuid": "e378b4ca-1b85-4931-828b-ad7a26700515", "value": "768:iyMV+N3wtJmuQms3n5UEoHL1lC5qLeWtefrYE0CQOqx8AgEgraN2DN66znbcuyDO:iyMMNUEFNnGh1gUUDYNiAga882nouy8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050063, "uuid": "216865dd-14d5-46c8-bd20-4f062e6ef74b", "value": 39388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050063, "uuid": "f15f38e2-1fe4-4bab-9dea-1f57ef8cef9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050063, "uuid": "2dc14223-5e44-4abc-8bf5-98975c543bbe", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd82ca2-d2ba-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765035911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035911, "uuid": "59e6762c-6e5c-4d23-bc9a-955cb4166941", "comment": "Malware payload", "value": "933887c163711c07aa76ebdf23e557eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035911, "uuid": "63c1a295-4d90-4f6c-bfd2-4b91e9032901", "comment": "Malware payload", "value": "235e0b80a093e6ae1eaea0a49846537a10222f358f025587bafb98bcbacaa694", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035911, "uuid": "5b74d2f7-35e2-496f-9dea-a209a4818ead", "comment": "Malware payload", "value": "ecf2bc3be70b5fee6aacb1b9dc6ee75e1bdb6be0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035911, "uuid": "7ba93a87-ca52-4862-af21-3266615971a6", "comment": "Malware payload", "value": "ffbe12b3f4c5e2a1571c03ee1a3cfc493a714e5137ddcbb44a24f2115ff4093af654aa9a00d31e9017e51ec9c7d3e53d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035911, "uuid": "a421c565-8a89-42ed-bb05-49fb925017ee", "value": "T1536612ADE6CB7785610C8A68CA881D50F815973F416128183F5086FC7FB57AA6A3DF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035911, "uuid": "ae03e307-b590-4695-a66e-b925969daf89", "value": "768:lZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZm:HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765035911, "uuid": "9540f535-5e10-41b4-a3e6-6059458ee404", "value": 6473266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765035911, "uuid": "1369fbb5-2179-492c-bcf6-31511a71299c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035911, "uuid": "9f22beab-1ad1-49b9-9f88-8a6d7607dcee", "value": "sample.js.malz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daff37e0-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048927, "uuid": "b50194fa-6c8e-4845-87a3-bfbfffe0d39b", "comment": "Malware payload (Mirai)", "value": "4c403ceed23f1d38ab9e29fd8bf64fc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048927, "uuid": "85425c0b-35dc-4725-8892-6e07401978aa", "comment": "Malware payload (Mirai)", "value": "2365840439f44f6ff831bf75c17caad5c7ea44a4465135695c7ebb95726a570b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048927, "uuid": "da912085-6426-4014-b6b1-b2d9c7dcb685", "comment": "Malware payload (Mirai)", "value": "9d2b65ee86ee6018a49dfd8186680eb1e38660fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048927, "uuid": "bdb7dba4-f123-44b0-bade-f683ee097550", "comment": "Malware payload (Mirai)", "value": "4790f480dfce0371c031576a2315721d9d84fda4c0252376f1a5c63ee18bbac525fae9ffbbc769317e10056299511f5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048927, "uuid": "bc4ed93f-2aca-40e2-a004-beefac751d0b", "value": "T16FE34B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD105F2577C7A6B0DB7A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048927, "uuid": "e6af6637-475d-4ebc-b52f-b51866ad5e98", "value": "3072:ENcMOvrpToDzK7zMeQzlue1k6aU9zL6EiueCo2kV:AOhoDzKXMereS6a4IueckV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048927, "uuid": "1e1ba2c2-0765-4ea2-9871-2fb09c81970b", "value": 145536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048927, "uuid": "306387d3-3dee-4748-8496-29242de69efa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048927, "uuid": "0cd00207-6552-49a5-9753-c0a26c1b70e5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460e7fba-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042235, "uuid": "ab8c509b-cb43-4eeb-a119-c273c08a5f0f", "comment": "Malware payload", "value": "adf6850fb81562e6b54e4fe2a053630a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042235, "uuid": "5c118874-7e1b-44ff-8993-e34872e98576", "comment": "Malware payload", "value": "2367bc63f02cde7ffd02f928aa971a3b6ffa43a92859969dddd548241f25720e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042235, "uuid": "50246973-c1d7-4839-8aed-080916408cae", "comment": "Malware payload", "value": "b4f15ac3d23cf67b52d63524abf3b59078612491", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042235, "uuid": "eb9ee130-ffe1-4f47-a652-f2164a621f2f", "comment": "Malware payload", "value": "db9156582788d4d6a34b64d16507668116b4ee301a0eb48d92f476bf3d0d5b60b4bba14db3ff3593ea6c3372eb1f83a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042235, "uuid": "5c6b6426-a56c-47db-9a5b-a4d699e0c41a", "value": "T14C947C07B5A4957CD05AC078935B9673A637B88E12307DBF03E096302FA9F612F6DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042235, "uuid": "a75e74c7-b7bf-496f-b043-adc8ce577c2f", "value": "162d5cb19f9e679158bb58228e17cd95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042235, "uuid": "b9612d4c-6ac4-44aa-8230-b0fb8417eaa6", "value": "6144:+6FZtexFia5HR+NhgjRTmVxJ+RmgKAR++2cHLSaxMCTLqytsnz6zvaAnpfGQRd4T:BUxZjRTg6t2crfxlTNtraALr4CoWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042235, "uuid": "4411b007-cf18-469c-a6f1-9207ff56ebe3", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042235, "uuid": "bee13458-79ec-4074-9b57-5f0ffbc681bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042235, "uuid": "8067127e-bcfa-45b6-910a-5f8a356c4bc7", "value": "nethost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ae16a6-d29d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765023419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023419, "uuid": "7feb2685-1553-4968-ab99-b966a7dafa4b", "comment": "Malware payload (CoinMiner)", "value": "24795cc4c536f9f594ca285b610afcb8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023419, "uuid": "7e659686-cca9-4cb9-8c05-b5932d24dd96", "comment": "Malware payload (CoinMiner)", "value": "2530ebc8e77c784ffe628b3588739ff096a2af4437656144983d1ba04b11538f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023419, "uuid": "9cc736e9-72b8-48ab-ab28-21456c52764b", "comment": "Malware payload (CoinMiner)", "value": "5c0c3a3d257476f55c92dd681e1be7b28ebc5e4a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023419, "uuid": "fa3b0426-5290-4c30-9012-eef0b7c9351e", "comment": "Malware payload (CoinMiner)", "value": "614ea28a487679c110e697cb7e65a2d4cc7135dd7187096b2e598bf53143106057c56d68e93d18f16ce0fc88c108957c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023419, "uuid": "22da0860-a80c-47ac-8835-84c5a8a9c08d", "value": "T168D533DD290F29F3AB009E0C33124A55D84C506B4CAB74B8CC9A67536DB89EB798F4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023419, "uuid": "2dfd78c4-91cd-487b-9531-1da0bd01ec64", "value": "49152:NSavxoEzNHERPLlb9kZmD+nwu4v2mjXYDPugzXoUjjgXB9A+02xX8UkKFMYbXu5O:waTMPLt9kZ1nwu4XEDPD8AgLAR2xvdFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765023419, "uuid": "d20926ec-abbe-4578-bff0-6ffe7d160bb4", "value": 2804644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765023419, "uuid": "fb0639c5-e91b-4b88-9f07-e60589548a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023419, "uuid": "7a5382c9-7e3c-4a93-ba09-a899a4321164", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcbaa36-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048929, "uuid": "d9ed8b7b-4d1b-48ff-a8fb-a43da8fc4a12", "comment": "Malware payload (Mirai)", "value": "cb4406fba6fffec1a0850ef96ccf22e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048929, "uuid": "cf7049d2-1358-41c4-b3d7-4f3c04478908", "comment": "Malware payload (Mirai)", "value": "260d31dcc0d2e3387dd83717a60f99096f8c50300ca4faea9167ddb45aab6e01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048929, "uuid": "8e642ed8-250b-4f5f-9efa-fcf078599491", "comment": "Malware payload (Mirai)", "value": "904f647cc4a832edcc918808833356a1b5ffcdd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048929, "uuid": "6ed184d1-ad68-4bc6-8e34-57dbbda8495b", "comment": "Malware payload (Mirai)", "value": "bfb56599b30737889c2ac0780459bc23d3c4041bddf50ae452e91b72d3b50c939cb911a308844b223dda8f6c4aba183b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048929, "uuid": "b95a2f4f-974b-44f3-ad2a-8eb9063f3049", "value": "T11D040905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048929, "uuid": "8696f42f-e711-45d1-9071-686b0e2260d4", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woAKZLYV0fCtZ1SD39rsJzjM9fx49SY2s:t3nEr5dfHPq7UTo7ZsvR9X0l64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048929, "uuid": "66a36f56-28b9-442e-be27-e155832be34f", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048929, "uuid": "654b4e3e-2b7c-4fc9-bacf-9af8853dd248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048929, "uuid": "ff893c55-f2d0-4e02-996e-6191a2681c2b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baffb986-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033841, "uuid": "e183b7de-14d0-4fc6-8561-8b29120b809a", "comment": "Malware payload (Mirai)", "value": "70df18f2c048100535ff731734f63174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033841, "uuid": "a4da541b-59a8-4e36-a955-20aa258c0ff4", "comment": "Malware payload (Mirai)", "value": "26895c7fd2392381d319fa154942e062cae5d50c100dc8c6a87ec6a18326ed60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033841, "uuid": "12b0b866-4311-40b0-a6c8-f5dcd1f4e3a5", "comment": "Malware payload (Mirai)", "value": "6e341d0b703f0cf87e617742844d71f7f49d2071", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033841, "uuid": "9dfaa6b2-822d-4851-8e20-64056ff18492", "comment": "Malware payload (Mirai)", "value": "3d2da92178f78601e78f4b326b353a319745ad3f3596a38a0297b187c5dd4aa04afa43cd04ab78823cb6bebc507debfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033841, "uuid": "b4348d75-5747-44ab-a048-b5333aaf15e9", "value": "T1FC334B25BA791D57C0E8647A62F3432AB1FA124F60B88B5D7D720F9DFF605C0A80B1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033841, "uuid": "326f803c-08aa-4a7f-b530-2aaa18606da1", "value": "768:jjA7oR5qN2ZGUrIauwyCQggqsdivO+P6XlkTDiHEb/:vA7K5qNAGUrXuwyXxdiT1Hi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033841, "uuid": "b74d3b90-a64b-4542-8ca0-6985d0024f42", "value": 52096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033841, "uuid": "05cafc58-1fab-4bf2-92e5-b748dc6367a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033841, "uuid": "454ee66d-f903-4019-aa1a-983d24ccef4f", "value": "b3astmode.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228ee3f5-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043464, "uuid": "5f0e0dbf-1d7b-4400-9f57-c5cefdd59a4d", "comment": "Malware payload (Mirai)", "value": "121c17f4e83e2ad159cd0f904272939e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043464, "uuid": "1b231b15-9e6b-4230-a30e-b7b0d845d769", "comment": "Malware payload (Mirai)", "value": "26ea2aed6e065afe991c1df79db494512e6a530f864599fbc694991a1a83cac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043464, "uuid": "7642ce0b-81d2-4f99-9996-be4e994a4ca2", "comment": "Malware payload (Mirai)", "value": "0781be2678882982717ef2798f51f5ce557bcac1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043464, "uuid": "39f68619-9da5-4fbd-ad17-670ca99316f4", "comment": "Malware payload (Mirai)", "value": "014fbcdfd01331c71fd2fc38c4cab6cb22a9cb36202d299c4a5fc5f648c9506afc6e6c3eb53a3afdfa53f81a8da2e012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043464, "uuid": "6ed01ea0-ba4a-44d4-9b93-090210a35bf9", "value": "T148F2E1AEE150F658CF4DCEB6442F2B729E84B1C4321F5F49232A08CA70106CF788A5F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043464, "uuid": "b97296b0-a47a-4b5c-9128-262039bcc97b", "value": "768:ucic7wjLheRcS2IvDCQN+Hc0ND+nZ52BJPbmj0/9CWKPzWN:RqVFQkDAZMBNqj0/9v7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043464, "uuid": "1a589650-18f1-473d-90e9-f820ef0a2352", "value": 37144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043464, "uuid": "a8393cae-5cf7-4825-8b7b-19ca1daf6f10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043464, "uuid": "0d0d8b40-6645-4e61-90c4-c2648d8eb52c", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99d2de9-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038671, "uuid": "9773047b-6f99-4960-9abd-bf529e684c3c", "comment": "Malware payload (Mirai)", "value": "8f95529449282872ef1131bf98a7c77c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038671, "uuid": "3fae9a34-1c67-48a4-b32e-e4b7916523b3", "comment": "Malware payload (Mirai)", "value": "271d097e660cb396494def04cb963afb93b8352d6c23d187f55a85ea2e59a279", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038671, "uuid": "7648bb62-63a9-49e9-a788-da8ffce3b32d", "comment": "Malware payload (Mirai)", "value": "f0224ffe729e47c7d6152e9ec636780a07e71cd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038671, "uuid": "fecc7779-eb05-4813-90d3-003271856302", "comment": "Malware payload (Mirai)", "value": "2d5a78f2e802884ff50ebee8d1090ccab58b848a5e7b330f54295380c1f60a17114886b6942d4dd7f2fb97602e21fd72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038671, "uuid": "d004a1a6-c2d4-4657-80e8-69423eb91aaf", "value": "T18B3110576186F9B2E222047755956F1B6B748CE26472EF0ACF506C01FC365D1D132324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038671, "uuid": "f6dc7672-8e95-4b4f-8e7b-c6b59cfba0ce", "value": "24:FlJqmTk0ee7FAzhlKZFViZOTVv7VidFGZ8/Y/C/+1uNlzxSkySuluoFRVa2fNPr:fJKG+LcFVkOTVzoFPY/k+1AzxSZSu0gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038671, "uuid": "3a36cd0d-e4be-40d7-b241-c4f63e7b0df6", "value": 1444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038671, "uuid": "0248680b-f58b-4ef2-9968-ba61c94ec796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038671, "uuid": "09f083e5-c28d-450c-9065-3e943c6b4a22", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78de01ab-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049192, "uuid": "e2afeeb4-acfe-4859-af6f-d1ba66972daf", "comment": "Malware payload (Gafgyt)", "value": "a542f5570ee036f9370d24236204fe81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049192, "uuid": "54d661ac-4a7d-4f23-8318-d4adb5450dac", "comment": "Malware payload (Gafgyt)", "value": "271fcd3c47cc6c1ffdedf78bed72983e193d0072fd6eeb9b6e57945a5a0034a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049192, "uuid": "23411e67-a491-436b-92e0-905cbea1c289", "comment": "Malware payload (Gafgyt)", "value": "b6779a34ac3d2fd32350f54b84c7495e8faba48b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049192, "uuid": "88cabbfe-08e7-4a52-b746-8a5b5239ef2f", "comment": "Malware payload (Gafgyt)", "value": "b14fbbd8e41f3f1785e9306486e95d7d155268f10d65c5ddbd066037754c10dc319cffc6d6486cd2301214edc542b697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049192, "uuid": "7e9bb22c-ddc2-4530-9609-07f681f232e9", "value": "T183F34A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049192, "uuid": "6549a696-022a-4a82-8e5a-a782d5eb8369", "value": "3072:llZ2CY6RdVz88M7GGQSaoIhRayniLZM/99DNmFwfBxKQodn:HZ2C1RdVzZM7lQSaVAyniVM/9nmFwfBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049192, "uuid": "b46a51cf-1338-498b-be09-edad0dbef539", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049192, "uuid": "f3e05d93-95fd-4019-b885-e9ab89a10ce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049192, "uuid": "b94a7ea6-d35e-4109-8937-2ff7080c0e34", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35677ba3-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006129, "uuid": "fef59936-44a5-4311-ae9c-c837b0f34612", "comment": "Malware payload (Mirai)", "value": "a68f2c3fd86ea5ca97b42eb0d73148d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006129, "uuid": "8ea45d8e-517f-4719-b004-3ad769b13b2b", "comment": "Malware payload (Mirai)", "value": "278397c326d2cd30140b645a5186834a2b384113ef64bbc1a247e9c3e6bde1ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006129, "uuid": "9d377ee9-663c-43fe-8c1e-8499b111d4cf", "comment": "Malware payload (Mirai)", "value": "f4dc3f885f4ea3a2e487f6320b14a244ac68a5f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006129, "uuid": "f3c4dec8-5c1a-42ed-8b54-bb332672b411", "comment": "Malware payload (Mirai)", "value": "09fbee30017f19b0f01f58875adde9bf4a83427c67c76cecbafc6c527f707ccf995c975b7e1248323b775daccbcffdc7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006129, "uuid": "a89ee476-ac9a-44be-846b-645d06aebe58", "value": "T1F701474FE672F373E542992EF616D0949596BC5BDA8AEFAC54C03D900488C05BA7B500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006129, "uuid": "bca78dbe-9376-4ea9-a433-279808e5a2dc", "value": "12:H27Rw7L5m8z7YUMXMFnIC+DkZa9Pakaqoe9SFn:HgRw9IUMXMd9+I09S/uSFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006129, "uuid": "4fbfe728-24a6-4885-ae9a-3617cbe2a3aa", "value": 722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006129, "uuid": "afb05893-3be9-43c9-9d7d-d3716ca6be4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006129, "uuid": "163d4ba0-e584-486c-8939-44f8b914662d", "value": "ssh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7edb248-d24a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764987880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987880, "uuid": "000ea484-351c-4f8e-b79d-f54e4a42286f", "comment": "Malware payload", "value": "4250b711296b18e0d522b263d8e92870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987880, "uuid": "097aa139-226d-4732-8ae3-7a5e501491a8", "comment": "Malware payload", "value": "27aef349f8314a553330a62799d5f68940ae56274124d569768549d3ec549d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987880, "uuid": "378b8ae5-119a-4350-acdb-ba25c7f1da7d", "comment": "Malware payload", "value": "7aa179d308ffa18bdf1ea18ecf4d7eb4af0855e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987880, "uuid": "4bdf6d81-858c-4969-ae5d-ed1b7df64aba", "comment": "Malware payload", "value": "2cbb4ed28e47792cd65177eb332d38fc0a9202cfc8e83b5b45c549e8d7ed62649b47d4101800413cfc7e380d78a8fe08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987880, "uuid": "31681c02-0b65-4937-bd57-1d896be604fb", "value": "T1F1F4337DDA31577EE895543E0C1BC2E09A339506F87B921978AD0F0278863B7EE5C293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987880, "uuid": "5dec0a6b-2809-4392-9cdf-b558d5455a9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987880, "uuid": "345ad8e0-e501-4499-bfa1-806e93cb29a8", "value": "12288:eXK3ouEM1Fivjxs7XUQyFc41oUCLXP6Gg+x4dg4uqLtPsbYN7:eXK3ouRnKjPQyFboU26Ggw2g4uqL6bC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764987880, "uuid": "250fffcd-bead-4376-93ab-fbf8ae58d6a5", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764987880, "uuid": "2d293169-e080-43b1-b0e4-736e42a9ec63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987880, "uuid": "595829b0-e933-4d8c-86b6-bd1988442cb5", "value": "SecuriteInfo.com.Trojan.PackedNET.3453.22603.30458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4bbef8-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038648, "uuid": "6870de4e-8c36-4cce-ab0e-5ec36deef9a9", "comment": "Malware payload (Mirai)", "value": "b19b5b9bcabb56254a97ad3fa0e6a19a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038648, "uuid": "298c059f-57ec-4d0f-8350-62d63f2c8272", "comment": "Malware payload (Mirai)", "value": "27b831e8c2ae5973e8c026c44f30dc6e6b6be5872ac02ebd77b5823b0b85b8ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038648, "uuid": "51a1625d-5a7a-40a8-a116-1a7292dc7467", "comment": "Malware payload (Mirai)", "value": "6c0425e122e5ba9b4c2e1abe6d2e250973a9feeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038648, "uuid": "82d0d91b-f542-4f7b-a0dc-1418f4cdc1e1", "comment": "Malware payload (Mirai)", "value": "a0c45bd83d47ce8adf5db6057a766b1fd12fc95cade003561b01f1f012f56058878333bbbdcabc3a698bdf980c285d71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038648, "uuid": "a494bae2-1a78-448d-bb70-88e1b2cb72e7", "value": "T10A5103A91FA0393FDE2ADC370119DB5923DC901F92AA6F466324E5003D0B7486BC389C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038648, "uuid": "b5f289e0-3e95-4a2b-a355-5289524a8b21", "value": "48:/ETnBEx02WQDqWcmmzpsoiASJbdNXawZ/0X1rz9syyn8s:/InBE0Q+W+zps4SJxNXai8XxRsyyn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038648, "uuid": "34d29ef9-836b-428e-9cb3-e5153118913f", "value": 2844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038648, "uuid": "74f21f84-e125-4a8d-86be-4adba8d63fc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038648, "uuid": "96454d98-8040-4a4e-8ba1-db63245d95eb", "value": "dlr.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a51f6bc-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1765038269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038269, "uuid": "ad579597-a5a1-43c5-96eb-3c7dd486ea4c", "comment": "Malware payload (HijackLoader)", "value": "861ae3d31f63a132da3779e9bfcbdc76", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038269, "uuid": "6202130d-8060-4a92-b8e0-1f2b25f93cca", "comment": "Malware payload (HijackLoader)", "value": "2852d54e19b288a571f4cac80210591d50b8cbc165fc99cf6134b26b95e7c407", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038269, "uuid": "495c1106-12ff-412e-aed1-e008bc331bfd", "comment": "Malware payload (HijackLoader)", "value": "34f2c99f8155cdece49b5cfd15aebcde5f8b1483", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038269, "uuid": "5411560e-0239-4fef-841f-4b3d57660262", "comment": "Malware payload (HijackLoader)", "value": "73d576fab1e17e5877b343412e1b2210ca8fe69c3b9de983c44cde1efd0d63cf7fb3f10fffefc936c056a0aef8eb8262", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038269, "uuid": "1a19135f-f2f8-42f8-a8cd-2db47dcb5029", "value": "T1C3463313BDC69113F54EC23694480AEE57FFEDE59F50050BA98E7AF938786562320FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038269, "uuid": "7260d74e-36a7-4405-993c-0c420c725fe3", "value": "98304:c9PJTIF+7Ktm4JMQg3Zxw2rnBWdfYrlfyRZ6UbGNZbB2BzIQBaTjY7UlpS64d:KR8oBQgY2t4CaRZ6Uw2jBaPpSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038269, "uuid": "60e788c9-7e29-4e30-8fa9-c080de3c06f2", "value": 5705728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038269, "uuid": "3366f572-fa24-4410-b146-2230f3135cc8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038269, "uuid": "c5ad02b1-b32d-4de8-b58e-76b22a62b28e", "value": "SecuriteInfo.com.Trojan.Rugmi.1.Gen.21422.31269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7223ecc2-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049181, "uuid": "b36433db-b945-4fb7-b6be-9602bb6be2e3", "comment": "Malware payload (Gafgyt)", "value": "3111777488d2a7360fa7ec95c540703e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049181, "uuid": "bf6dfba8-9b4d-4db7-83f9-ca0d2beda306", "comment": "Malware payload (Gafgyt)", "value": "288e6fc449440a9246db99f3713560c1f07f3f2af706116b956c4f3375b16221", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049181, "uuid": "8ea5a150-93ad-43e4-967f-bbfb396bd190", "comment": "Malware payload (Gafgyt)", "value": "242447c7facac67a7457937514120024888ce1e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049181, "uuid": "1f7b5f21-bc27-43eb-a578-3ae5695422e4", "comment": "Malware payload (Gafgyt)", "value": "b151f56c866843032c34f0be6b07f923c61cbe10c2e02b1478413980d6ae7e2f5e90d02c0be38e966c4891aa4fe3b85b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049181, "uuid": "9eb1fc13-345c-434d-afb4-961a91e3c7a2", "value": "T142C31805D5508727C2D3237AE79F865D37325BA4A3DB33215A34BBB82FC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049181, "uuid": "0fdabd83-9355-4d6f-ad29-5764a3c6bdd9", "value": "3072:G4I38tWYnfb887aytLTYsD+0Z6+mTQOY5NX3cn:hI38tWYDN7amYsDi+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049181, "uuid": "60914d06-f041-43ba-963d-218ecf82d354", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049181, "uuid": "a36e8116-0dee-4a50-b673-f6ef5ced5166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049181, "uuid": "c7d4f2be-d9a4-4c86-b941-2e34461f7baf", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78bfc9c-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050129, "uuid": "54d5586a-93a6-4e2a-874e-635731016e29", "comment": "Malware payload (Mirai)", "value": "ef7fafb9988d8c7c0a6986ff664c549a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050129, "uuid": "c6fef133-8258-4522-a34f-5cee20f26d0a", "comment": "Malware payload (Mirai)", "value": "28f2201eef9aac474d3ca5a4bc1d0d0881753ed473a4ff114e6043a4c268db63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050129, "uuid": "30c3de19-dfe2-46eb-b078-a857f455164f", "comment": "Malware payload (Mirai)", "value": "37e8229ed32b45d2bd48995e9e1930cfe5d6c2e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050129, "uuid": "26f762e7-1d4e-4be3-b3ed-bb3cce8f2f78", "comment": "Malware payload (Mirai)", "value": "9bbc2dc3f80185a5e7b51badc5bcb3ac49cde8967f24397185aa02e6765ef9839c5b15180468cc88b3006a8605394b24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050129, "uuid": "37caa691-dcef-44d4-afa8-50c902db846c", "value": "T1DA43F7A1FC92859AD6D05772676E568A33B263A9D1DF7303DC180F1027CA60F8E6BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050129, "uuid": "e3c3ffdd-87b3-4fe4-9915-5fd904dcafb9", "value": "1536:xF2/Ob6aZdrkXzLP7lJGGX3uPGBHE8+BQy2:i/Ob5DrKnOObHE8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050129, "uuid": "d12a1a19-0579-4293-9c5b-7d1c27b3d9e7", "value": 55176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050129, "uuid": "0b5176e7-0c7c-419c-abed-87220448c054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050129, "uuid": "7b43d65d-0d02-4b9f-a8b9-fd57d4e238dc", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1460ec-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042247, "uuid": "e5ad0806-0cc8-4eb2-9eb6-243acbe860a4", "comment": "Malware payload (RustyStealer)", "value": "490cd78c3d710b64d42b0e6fdc95b894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042247, "uuid": "d09004ff-3dd5-47ab-ab6d-5b2139c32378", "comment": "Malware payload (RustyStealer)", "value": "295f07e8185948de7b0372e918b1f3da8abc0b51f443c3a761af48257491c72d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042247, "uuid": "64207468-5081-4431-90a6-0a49847e1ac8", "comment": "Malware payload (RustyStealer)", "value": "96c0332f521e6cb87e884b413e97eaae64f876fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042247, "uuid": "3563b4aa-d881-4846-8523-29b787cd5fbf", "comment": "Malware payload (RustyStealer)", "value": "4e792045f2cf488bc0e587bf8b04d225003867e3aa24531ac268c46ea8e6e77a975ec71c798f1090e49269e7eda4fec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042247, "uuid": "0464eba2-c3ba-46ef-956d-d8f218267e62", "value": "T12A857D07F2A191EDD09EC1B48347AA33BA36B8890621B9BF17D15A703E66F514F1E70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042247, "uuid": "6ed71293-ca44-4697-9911-237759844e0a", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042247, "uuid": "834ebc92-ed61-41ea-b6ed-cf48c444f9ad", "value": "24576:p8Q3fRoCz6vnrk9ghaghGSyarBhmic4oLUXdveG+5GE8M3/d7:p8Q3feCz6vThGSyaNsrUXdvex5GE8M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042247, "uuid": "e85f8f81-9208-4638-bfdf-4427834c752b", "value": 1710592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042247, "uuid": "bf38853f-0349-4459-937e-a1ab19cd4af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042247, "uuid": "fff02427-7342-4392-9e95-6b8450e53b25", "value": "new_panel_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e59fbcc-d2cd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765043940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043940, "uuid": "c90881c2-dc35-44cb-bb97-295141e7b472", "comment": "Malware payload", "value": "b4d5c7c712c0d02860df08e5774a9dcf", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043940, "uuid": "5d872e68-6f6f-41fc-9763-d77e1beee3b6", "comment": "Malware payload", "value": "2a2dcb59a314c7b0157fa7c4fe5b6b0176d6349983a4bfac47ff79fa3b2cf8b1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043940, "uuid": "11993df0-9b0a-47b8-bbdd-e2b0d0b3b9c0", "comment": "Malware payload", "value": "30a9deaa61de5b8eb5bea686bcc2b2b84542752b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043940, "uuid": "61670977-ba2f-4e49-887d-69f68eba8a59", "comment": "Malware payload", "value": "44cc77db41863e96a513eedae1ae9e5c3a1777e0988f9d2827fbbefeb25cca4857aad47aac9af5b71e61bc7090e2f2f5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043940, "uuid": "31cf5d08-5c4c-462e-b49b-b6107d3322c0", "value": "T1577384981DCF84E85A277468C5DF8C21F7A58E030E3CC6C5BE5CA9A07F2582DA5F85E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043940, "uuid": "80a7698d-b1a8-48fa-8125-9db177feb90e", "value": "768:gzKsydy/jVr8dRQoD+vTP6Dqi1DRcjr5P3/2pT4DZqEXuNm/vI7osl9hQkXQ7HNm:lsyzDevqqvI7oO9dehp22uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043940, "uuid": "0d49e5fc-911c-4b62-a89f-79fcdc9ecbce", "value": 77617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043940, "uuid": "b8c271d4-627b-4692-805f-b6d6815491ee", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043940, "uuid": "3aa5e05b-c8b0-49cd-978b-58ce22c4b28d", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f7290f-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038670, "uuid": "23ddbd30-fa0c-47c9-810f-3f2379340fda", "comment": "Malware payload (Mirai)", "value": "0575dde540d47d56d12cf915262573fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038670, "uuid": "884eeb16-7dc4-4dc6-82cf-ac54418ab47b", "comment": "Malware payload (Mirai)", "value": "2a98cfb44ab6cb3d51601d52765bd13db029d567015592038ea1554193b41ced", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038670, "uuid": "c68677a5-e78a-43ad-a904-5fe5292ce2f6", "comment": "Malware payload (Mirai)", "value": "b1595b09e4006c8c6396aae46967e942147e4155", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038670, "uuid": "c3199e3d-0038-420f-b680-34190e8e3ba7", "comment": "Malware payload (Mirai)", "value": "e02934af801bd627cbf51d77cfd04b4be6316060e3afb7784357b0f3a0ff55d74c09a8c2c373e742f43d621873bce3f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038670, "uuid": "d68808cb-f199-443c-8637-cb96445ae98a", "value": "T1DF934B0172280B97E6A34DB42F3F2BF187BA9D4220F4754A680BFB4696B1D325457ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038670, "uuid": "f32a48dc-b53b-486f-87ee-52ce9363554b", "value": "1536:m7c4itAd+K3ONxbxWtJDGsB7VaITmt2RTz4UiaGA0AkkzkgP/00fzzHEPrm:DptAdT38xb4tMsYHA/30s4Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038670, "uuid": "3bcaf7d2-7f35-4620-b54e-ba8d3bc3a5c3", "value": 94924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038670, "uuid": "b2ef69ec-c79c-48dd-95ec-9644ec997eeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038670, "uuid": "c8f754ac-6e2a-4fa5-9699-41f0912d231e", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3585ce65-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003123, "uuid": "9850f748-17ea-4ac4-97c3-bb3c3f08a551", "comment": "Malware payload (Mirai)", "value": "68effcd84a2162f164f390e68ecc78ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003123, "uuid": "89f6bb1e-8b70-46bf-926d-63316d1aca4e", "comment": "Malware payload (Mirai)", "value": "2a9d8118cbb9b6c5118c246f8ba4fd9695f1960a267993503871273aa79bb359", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003123, "uuid": "a935732b-35c6-4a64-bb15-0debd0703119", "comment": "Malware payload (Mirai)", "value": "97c8f4b447aa48a618fadc3cc696b9620dbee6fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003123, "uuid": "75a81dad-eefe-4cff-8d3c-a585c9efef83", "comment": "Malware payload (Mirai)", "value": "3fdd81dc43fe2c2523dd568bcaad36abe62ffd3f9347f7a9ac5dad138bf22901c45deeb9de51374d1a19fec8e1b20b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003123, "uuid": "6a8b46ab-4424-4dda-8dca-aa8024cb61e9", "value": "T1A2834B41B9428656C6D923BAFA6D128D332673ACD2DE7217CD216F5233CB82F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003123, "uuid": "7503e821-502b-4a71-9860-d968174b4ce7", "value": "1536:LEoHXxnurDX5RAJ+hqEcqqUp4tMREqB5G5SE5S7ZPxypxFXkFm11eBM0:DBnurDX5RAcQE2w6MREqBM5d8dpsxFXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003123, "uuid": "5332d5a9-6d8a-4fc7-b1ac-795bc651e93e", "value": 83584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003123, "uuid": "f186da7a-9599-41a4-a28a-f3aafbbaeef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003123, "uuid": "ba725ae1-3a1b-4944-be92-e46afd21a6ce", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb20d20-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006115, "uuid": "f40c8461-9962-4a77-b90c-d301c1f73479", "comment": "Malware payload (Mirai)", "value": "ff2f05cde3244481fdbdde5ca88adddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006115, "uuid": "05fa3f6a-9e14-42d1-9ac0-db62034cc70a", "comment": "Malware payload (Mirai)", "value": "2ab8fc8c4cebfdcb983f03dc1716b4ea8fb213691ad6b6527692953cc4377e74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006115, "uuid": "a2a2615b-283d-4b00-a3c9-bc4d5a9729d8", "comment": "Malware payload (Mirai)", "value": "0099fd6d15b9b9e55d32b007258d970908108714", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006115, "uuid": "e09c1ac4-3dc5-44d2-9581-4657d349c7ca", "comment": "Malware payload (Mirai)", "value": "bc145c84b12b7185fb142e58e2b6568ae33b1621d4e7cdf8293850e065adbf180831fe5a215ef480bf415c491217196c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006115, "uuid": "50681af2-9a91-49ca-863f-1e624e463b54", "value": "T13F313306EF1BB47CF81691FD896703F69E21B8EC23397642AE0959020C0A9E0189C491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006115, "uuid": "b5be0c91-eea0-4653-a090-36197f946673", "value": "24:GHOpHZAXmJSu2gdW20Amljh0aVxJwD6nujoxcozffTTqf:GH4ZYMk20AmJG8wD6usxLzXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006115, "uuid": "08113bb1-8533-4da5-b2b5-4b8f52b61b83", "value": 1688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006115, "uuid": "30d41514-9cd4-41fd-b487-7108ea350068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006115, "uuid": "1f700bef-5f72-4bc3-8925-c539672f6c92", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a467ec7b-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037669, "uuid": "76de37ec-2250-4b3f-8cbf-ec60ffcc9c94", "comment": "Malware payload", "value": "671e5d383528597a5737323f424cd620", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037669, "uuid": "fb1740a0-f348-4139-b673-dc6edca06e53", "comment": "Malware payload", "value": "2b8e546074242463071eac2c0c2b32a7c1ae58534f6dec036fed04f3466eadaa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037669, "uuid": "39dd310a-5a75-4b71-bb47-69fe5d9057d7", "comment": "Malware payload", "value": "78ff66b69fb59c218627a7534be3bfea2333d639", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037669, "uuid": "3ea97a6b-d520-498c-a574-9d1316c95503", "comment": "Malware payload", "value": "590b0489db9d0d165d78b8896a00e67040bda4100ea7b2006db79cc67cd9745e308aaa22a50be5f110f4913d8d6fb486", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037669, "uuid": "505a0246-453d-49be-803c-12eb4a302354", "value": "T1E508334687DC781EEAB38076CBED0B5B6AC98D019342C95B88B6762CC5F3BD494D4EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037669, "uuid": "2b3c5d1a-c714-43e6-aafb-f81eb0fdfc86", "value": "1572864:r45I8FiYeVLySTOCY8eO/p2Uglx8HAs3pnrE2Y29SBIaYf65eGbimaUPYmaUPG:r45I3nNym/t/pyQFbYGSBI/GbiJDJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037669, "uuid": "cb298ff4-4c71-4e1c-ab98-cc4cbd0b704f", "value": 80252053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037669, "uuid": "b1c5d7d7-388e-4f06-a3b4-fc9ad25c1df4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037669, "uuid": "8a5cfaec-0565-48f5-804d-b71558f4c96b", "value": "mega888.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79022b8-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033835, "uuid": "0b60f432-784b-42d7-8096-401e1e80b699", "comment": "Malware payload (Mirai)", "value": "c625720ee8b4ab609ecbd353c29bd8f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033835, "uuid": "13a49cf1-6ca2-4b78-acb7-becd771d6fc5", "comment": "Malware payload (Mirai)", "value": "2ba4ad3d65f6be64e0855c61529b121f62f1899cdb7cbca78f5bb0697c8071b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033835, "uuid": "7f25df68-81f6-4182-8956-8ff942ce6fee", "comment": "Malware payload (Mirai)", "value": "7020b34daa276ca5c93637a9833dc80add2553e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033835, "uuid": "109eb04d-9c61-4e41-8026-55580832343d", "comment": "Malware payload (Mirai)", "value": "549d447a4953becc03e7fa1fe2c16c107dc5b2752790ab6673e139181bbd8dc4e4ffd7199beb0230fa082aaf92e943bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033835, "uuid": "c8ec2d51-59b5-4c69-a3db-4c8b6d996175", "value": "T18623F271710899E3AEA0D833E4E2AC8378BB5E76D0BBB19702B84DD087669535174497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033835, "uuid": "dfde30e0-d085-4efc-a170-d70a0f11d01b", "value": "768:ctf3ZnAnCh5cx6kq4SDNmfHwerUSFAsYs4eaG9q3UELiLnI2t7+uFPS+b:ch3ZAnCko42m/werUUHHarLiU2ti6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033835, "uuid": "ef4c4c87-3919-42ed-bf4c-f01ec8ae68dc", "value": 46792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033835, "uuid": "355b0e9c-a43b-431e-a7d5-c0f02cb25897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033835, "uuid": "33bd8851-3577-44be-ba02-904124c8bb15", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3d0f61-d281-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765011484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011484, "uuid": "61111e63-d1f0-4b2a-b519-e51a3fbba3bb", "comment": "Malware payload (AsyncRAT)", "value": "98b33cea6337cd5384cff21a297ed08b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011484, "uuid": "a2af5296-1875-4787-9abd-381dd339d2cd", "comment": "Malware payload (AsyncRAT)", "value": "2c382f00d6e1aab4af1dbfc44a0e2af6ea8611f76013a06a2484bbba4f7d28ef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011484, "uuid": "646af734-ffaa-404b-b64b-5d2e5215a5f5", "comment": "Malware payload (AsyncRAT)", "value": "6a3b78cddd2e1150be1e8574280310613e621179", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011484, "uuid": "9bee47d7-445e-4980-bc6d-b26f34dc4d51", "comment": "Malware payload (AsyncRAT)", "value": "3cef32a278c9f47e3adcb477c12cfa9d8c97dc2b4bd0e0474cbcf579a2752d8e85051fd39d4c441cee61bd5a220f0744", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011484, "uuid": "c1c20421-d7a5-4f4d-99f5-a570b07d641a", "value": "T171233B0037E88227F2BE5F78A9F25144467AF2637603DA4E1CC451DB5623FC696426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011484, "uuid": "1d85bbbb-964e-4a5f-8613-dd167cce7d85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011484, "uuid": "13b0b619-afbb-4bc8-95f1-59895a6411bf", "value": "768:fu+01TQQEX1WUVt1Pmo2qjUqKttbOpWs0PImzjbggX3ixAMubGM2i9CfrFBDZLU7:fu+01TQfb2rqgtWZ5m3bHXSYG/i4zLd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011484, "uuid": "218cf725-f786-4242-9ee0-59e035520004", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011484, "uuid": "4bf5ab46-0c4c-46b0-9849-e48ce62be0d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011484, "uuid": "70488d9b-fb13-4af8-a131-533117c3b36b", "value": "chrome_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f6cbda-d2e3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765053585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765053585, "uuid": "be083382-9fa0-45e1-b1b8-1128630a8714", "comment": "Malware payload", "value": "3234788f1602cb04127d9e4d90ddb3a5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765053585, "uuid": "590e0728-635f-4c04-a2bf-f49673ef0ce2", "comment": "Malware payload", "value": "2c52666a3469365856e84c4ede2db3bf5ebbc126aa0d85e30c97ded61308ba2d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765053585, "uuid": "cb7401ae-e547-45e6-b5e4-1ea366bd5102", "comment": "Malware payload", "value": "1b078d36030c80b30eaabdc3a62ca4d1cd45d334", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765053585, "uuid": "d8d4f7d7-04e2-4ab1-9cd1-8f6097c195c2", "comment": "Malware payload", "value": "88c31c712f8e982b4a2f440f9dbddc23ca9da567138b2659b94d2895ac3272a884f459b0c0aa423d084645aa8b0c1e22", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765053585, "uuid": "c68d0a2d-e224-4eee-ba83-43134445876f", "value": "T1F5760842B9524969E57BF2399051E250B7317C0943F13BD36FE817698C2AACC2F3EB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765053585, "uuid": "61e4fe74-b122-44dc-81c0-63ce65679a50", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765053585, "uuid": "5bc67440-a6c4-4adc-bb92-3d1dc48d556e", "value": "49152:UesZi33yDtPWARB72U4FiUqac79tyTVD+5wLKa/YRtGqR6UK1BpVtyTVD+5wLKK:mA38/2cf0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765053585, "uuid": "321f1a4c-125e-4110-b277-7d05c4f676e2", "value": 7443584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765053585, "uuid": "ec3be4b5-555b-4649-b9b8-6e8a935ddf33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765053585, "uuid": "f45a15ce-60eb-423e-8c3d-81cf0f111294", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38484b59-d25f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764996685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996685, "uuid": "04b90bb5-bccd-4467-9ab8-10390dca9464", "comment": "Malware payload (Mirai)", "value": "82c7e98732f1aad95e85cd029126c758", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996685, "uuid": "1a7d8789-7312-4544-84df-f3bf9a414ceb", "comment": "Malware payload (Mirai)", "value": "2c91018d224e5b3abf9339b4cda821e370cb193481fea2a7cf78a44186f5a1e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996685, "uuid": "de0d4b59-2a67-403a-bda9-48dfc355c7ef", "comment": "Malware payload (Mirai)", "value": "eda05aee1a4fa38d36cacd32736de114e0ffff14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996685, "uuid": "b0a245ff-4bf3-41d3-a297-1f19e4ac048b", "comment": "Malware payload (Mirai)", "value": "f5c0454063e966f5e9210e0f58837e6b383456eec4b068b0fed59c972869373d1e030e628d9b59b5edcd70458a5af692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996685, "uuid": "80398d3f-3602-4a3a-99b8-e7085fd42de5", "value": "T137043A07771C0A83C0A72DF03AF727F087ABE91116A66584E21EFEC41377AB16519F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996685, "uuid": "e2ceb3ed-b9e8-40fc-bbcb-b997a1ca1924", "value": "3072:vcxH42FPnxIam3xd+7YmPaGcPl72gamDGwCil2/JIzqKsyVl:k942Vnx9m3L+cmP5c9zamDGwCil2/JIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764996685, "uuid": "3636e362-41f2-40e1-b6cb-588835ee44b5", "value": 185133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764996685, "uuid": "936f4aac-019a-4923-bd82-e0e8b523afa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996685, "uuid": "8874ace9-9ee2-4522-9b60-b711167f2fcc", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c4f56a-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049187, "uuid": "6a8c38bf-79ac-46ce-8a93-eac38d382103", "comment": "Malware payload (Gafgyt)", "value": "e27c4eb23577f3db1c2ae0e51bde32ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049187, "uuid": "56f099a5-49ff-469e-b7a9-7a6c0f9b58d5", "comment": "Malware payload (Gafgyt)", "value": "2cba2be6712fadce3c5cea9e12ba5187be3f59e52f684d2e8ab9c178e587636a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049187, "uuid": "bf411647-94ed-4d19-a16d-5ca9d1d53fec", "comment": "Malware payload (Gafgyt)", "value": "b7bf99e006d1aa264095acbd94f94d3cde7cc0fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049187, "uuid": "c7a28b8e-7953-438f-8024-04bfb579819a", "comment": "Malware payload (Gafgyt)", "value": "72bf70bd3c8708ec6a4637ac1aaa79a8f06bf422992839e4ac1b1b99f82969003b2ba4d5f3a50514fbb3d41e296875e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049187, "uuid": "555fdad1-b44f-44a8-8977-d31ec1585ada", "value": "T1BC933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049187, "uuid": "a03e7b19-676b-4897-af9b-1765a643d41f", "value": "1536:9QK1n/zXzxuPz5tq58MBtcaKECp/dC1k+8/MLumXxVqDrstKfz9e:99bzI9ytcaT0tMLumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049187, "uuid": "01d0663c-07e8-4ef3-a7f5-4d387c5c9b89", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049187, "uuid": "857a90d2-4963-4ff9-949d-f633797f8fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049187, "uuid": "adc89350-7078-4977-bfa9-fdbdade9d3c9", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a2eda7-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049183, "uuid": "815ed4dd-98b4-40f6-aacd-d0452d9b79cf", "comment": "Malware payload (Gafgyt)", "value": "7bfc2b3c2cabbcec23e9830a5338e5bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049183, "uuid": "ce08ed42-6005-44e7-a0a9-b787f28d05ef", "comment": "Malware payload (Gafgyt)", "value": "2d49b935c8be0b3436b9afda72f8b61736e8245b62d4047d25f75f27c39a7249", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049183, "uuid": "b2bd2194-d924-44ac-b0a4-efb00d1e063a", "comment": "Malware payload (Gafgyt)", "value": "f9b300853039a31017ef88de18d83a7b3b690add", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049183, "uuid": "7381279a-5a61-46ef-8759-493509efe397", "comment": "Malware payload (Gafgyt)", "value": "6b9ebdfc0874540e44cdf93b5b40f638a6df37db476245965b81c78119a5e59a7a543becdb03f1cd23f8fa13729f173a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049183, "uuid": "d58262df-ff36-41bc-9905-d8aba2d2bd66", "value": "T14EC39417BB618FB7D81FDE3305AA8902108DE58A12D96F6BB2B4C52CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049183, "uuid": "9205d8f3-752b-48c7-bc5f-0334e9052096", "value": "1536:/RHeT9CAms/Y8Zm3lKYA43gMJwSkJ8EpxyLrUhsrmW+IFB1Df11hR/:/R+LqAmgMJM8ELyLIsrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049183, "uuid": "b5e8f462-bc03-4429-8721-2e44096a89f0", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049183, "uuid": "4496c0b8-2d61-4340-957c-ea4c09679bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049183, "uuid": "c82d7438-b195-4a1d-be5d-237a08193c48", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3044d8ac-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981639, "uuid": "e48dbcb4-c582-4b51-92bb-3041e9e37b0c", "comment": "Malware payload (Mirai)", "value": "3fda976f779220b695f3f7f2237072eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981639, "uuid": "3f84200f-26c3-41fe-83b8-b362a46565ef", "comment": "Malware payload (Mirai)", "value": "2db7b4295ce26d777814a644ee9166aa2519fc1f9b169809ef1d64bc96340c46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981639, "uuid": "5a58b0cf-53a1-4a02-998d-6738d6cdfb60", "comment": "Malware payload (Mirai)", "value": "23919977add17dc4bc3e4c212ba445ce12e3dade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981639, "uuid": "afa840dc-b96a-4045-b0a2-68d491bc5eb6", "comment": "Malware payload (Mirai)", "value": "832123216625738fef4eb6ee57e24c7c23fb3614a93698aa0953cbf0d589c803dffd0c893304a4b6552377dd3e2d4e71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981639, "uuid": "fa68ea3e-4717-47aa-b761-f02ba94ed2eb", "value": "T1C0837DC49687D9F5CD06467571B3EB338636F437222AE983D3D89A23FC529429A072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981639, "uuid": "9de2e8d5-13c3-42a6-a2a3-4d603ff4df2a", "value": "1536:6lATE58h0hGZuf/H04AZBCyajO1sL6M3hQGmwmHrHhRWoBh1gcASCi:6liE58h0hquf/H04AZBCRa1sL62X5orN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981639, "uuid": "82db9d71-8052-4e2b-868f-ec7cf182bf7d", "value": 84272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981639, "uuid": "7f967652-54bd-48f4-afa1-375067a4188f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981639, "uuid": "3d3121bd-3429-4a97-aa11-908961138ac0", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd3ec37-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042171, "uuid": "a18f94d4-1ae7-4234-8366-4fbfe6b51bf0", "comment": "Malware payload (RustyStealer)", "value": "0ad2f5880d34e9f231a28f0c0cad015b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042171, "uuid": "8c40008e-680b-48a2-a940-8b4dcece0c64", "comment": "Malware payload (RustyStealer)", "value": "2e6220c3ed90261bd9f0d30cc3684e7c3f763ce524fe7ff49de7bf92870031e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042171, "uuid": "cdbc415d-932b-457d-9a93-e1a71137c402", "comment": "Malware payload (RustyStealer)", "value": "575e763b941f74ef329e37715c46fac45abb3985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042171, "uuid": "93890c03-7909-428e-be99-0f81e47b9835", "comment": "Malware payload (RustyStealer)", "value": "df5c0ca2390c7b66f04b8b1a7f01b3a2cf942e001c5915afec37f987fa02b855e5e90b9b86e8b2c1d3181c0330dd485f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042171, "uuid": "188d117e-2b58-459a-9b05-4860574d4bcb", "value": "T157A56D03F3A581A9C1DEC1B98705A775BD7BB88D096076BF0AD34A303E69E944F1E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042171, "uuid": "ff553bfc-f31f-4d3c-9ce0-6eca06b1ca6d", "value": "5aff6c59906e71ba7f18f6b50812a6ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042171, "uuid": "e8eaba63-38c0-4cd7-ae86-222031de3ccd", "value": "49152:JGjP0ydCl6/xSe7J88HxzA+8kgMWRIO58Eg:JGjPrJ88H9Wmgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042171, "uuid": "3b507e6f-4cd3-4941-9f1b-80fc0c658913", "value": 2129408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042171, "uuid": "fbd7ad36-f9d2-4a99-8349-ba1029fa3b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042171, "uuid": "bfb2bf8a-396e-4e7e-ab5f-74ea0a75e0a8", "value": "dec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05200a82-d293-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765018933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018933, "uuid": "cb895370-5c87-4e32-9936-6605060c09ba", "comment": "Malware payload (XWorm)", "value": "3fd38bfd701d5ee8f05283aea8ef4aa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018933, "uuid": "345f3ad4-129f-44e8-9769-ae348df07132", "comment": "Malware payload (XWorm)", "value": "2e7951622565afffeb33ad68d589d0884f928a137a97f470e189d3461fd74421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018933, "uuid": "3cc4b983-139e-4236-9c6f-e3fff3f18a45", "comment": "Malware payload (XWorm)", "value": "efd5ba1a0fdb53c5a3c03d51dd5b0087d31bd47c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018933, "uuid": "dbb2d762-bd0c-4a49-998c-407132f78268", "comment": "Malware payload (XWorm)", "value": "da11741acdbf7d81c8c1f655f8a8ccfc5e2f59e2e2c3d0d9585d8497f3c5017f7bda60ff12b62109adafc6160250d223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018933, "uuid": "b54b7d0b-2c3e-417e-8e2c-19f43f4bec0f", "value": "T151B40A0FB2555E20C7445733C0FB05009BE59A42F6A3F34F7E9B13E629133AAD9A6687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018933, "uuid": "0a41e4be-fdbd-4fd3-8067-d17970643b81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018933, "uuid": "e5bfc264-5371-4589-8e37-a06031a978f8", "value": "12288:aQAolhaGbRjXOKE+qHFhjOJ5uKEf29zn:a2h3rNY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765018933, "uuid": "a331896e-5d3d-4a6b-a9e2-074cbaff5444", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765018933, "uuid": "c016e8b2-70d4-400f-ae61-55e48828b931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018933, "uuid": "682257b4-0ae2-4194-9d53-4bc845023029", "value": "TL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14ee2bd-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050146, "uuid": "07d87c93-a3a0-42db-9a9e-9aa017cc0a8e", "comment": "Malware payload (Mirai)", "value": "bbc418b9ea945fd322cfb19268c4cd34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050146, "uuid": "0053790b-142d-45f2-9c59-21e2f58af4ea", "comment": "Malware payload (Mirai)", "value": "2e7ad1af8be4819bfc677b1a6f10f0d9aa0405b86cc775230189ca121b111dff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050146, "uuid": "a1e05316-0dfd-4d29-9b04-f2d65669237c", "comment": "Malware payload (Mirai)", "value": "b2c5f407415880da8bdc8dc67432ea0cd281b674", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050146, "uuid": "a073572b-89fd-458d-8712-f8a97721f972", "comment": "Malware payload (Mirai)", "value": "2a7b90262e8e4016678d40071b79bf8b3b3c58824a470701cb70ebafc8939749cfc7ddb9dbd23e49ba499c4d70d1d153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050146, "uuid": "1e1aa7a2-fb5e-48b7-bef2-0f26963bb97b", "value": "T19B736BC2B743D0F1E9260632227BFB324633E53E0029DA42D769D876EC52A41E66639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050146, "uuid": "4e18d828-62b3-4b7e-bee9-a201a8787f30", "value": "1536:t6BYOT1H4yLcTH1juzyfUtyZwW3/tjE1rkZsSYhRSC9LwBd:tat4yYJj7MtGwW3VjERAt4LwBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050146, "uuid": "dc46bbdd-9625-42b5-b8d9-3fc55818fc74", "value": 80304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050146, "uuid": "5d8a7f13-68f8-4b92-83c0-3f0b4628f0d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050146, "uuid": "020eebe5-1cd7-4fb8-b66c-d24477d9a073", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325f5e1f-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006124, "uuid": "e5d1b481-7496-480e-bfe0-9454d550d64c", "comment": "Malware payload (Mirai)", "value": "9601671f92608a12fd8372c6cf106190", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006124, "uuid": "8e737a88-0162-49cd-9991-909594c9eb43", "comment": "Malware payload (Mirai)", "value": "2e9c60a108c35e5bb30a357fe965f61c8e6d4020c783350dddede89aba0b5427", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006124, "uuid": "c9b2f0aa-748b-45e7-823b-861b32e94682", "comment": "Malware payload (Mirai)", "value": "6af73ab8954eb25db2d703a684b92ea5b047e1ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006124, "uuid": "f32763ea-786a-424d-a1c8-00fb53935b37", "comment": "Malware payload (Mirai)", "value": "04d735a0369001d40c8a16a2d390de4e852163b7950d5b59b0898db10b80dd7b5f4808afda74523f212b5214a5ed0e34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006124, "uuid": "e12c643f-af58-4936-9aa0-b87912fd2638", "value": "T1C721DF48FB8B6E9FEDA35039680B0A1541B0B626E8130523E364DE7F5A37299125A4CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006124, "uuid": "76d51fce-98fd-48e9-b8bc-fc25c75c5f17", "value": "24:3O/zdz8Pv62Pewc7CreWSJMdq9HHOlDSD+z+sSyYT97tnKi+v9PlO4L6fNjvrO:KI621sClSN9nOlDSK+NLT9w9PlO82NXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006124, "uuid": "bcf02e8a-c550-4011-a5e2-4b1947750211", "value": 1408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006124, "uuid": "2a8e2321-6d31-41f3-a539-32f28aca42ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006124, "uuid": "d524fda4-3232-44cc-80df-fa88a925d157", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765ff55b-d2c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765040598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765040598, "uuid": "a2e4adec-7751-4a85-a60f-f10161f0780b", "comment": "Malware payload (Mirai)", "value": "639d8fa799e0613616f62bb044ec4ca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765040598, "uuid": "9bfe8b2b-be71-4354-9a77-125729e89d98", "comment": "Malware payload (Mirai)", "value": "2ee71439ebc752ecbce875bd315653d712b467751faea731466e8f577132e38a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765040598, "uuid": "2c71da16-441c-410f-9403-847a536a388f", "comment": "Malware payload (Mirai)", "value": "902ee00e8efa85e6dd86d06e525ea149a996d519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765040598, "uuid": "4b07c1b5-3312-4148-9541-d3f522abdddc", "comment": "Malware payload (Mirai)", "value": "d793e5f9f0fed7cade009a47ca31e57fa4ad51a4b6f3d9cb045c016756edc9babde906e047b76a521c8d1f58babca4c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765040598, "uuid": "6f5075e4-7d1a-4494-906e-6c825bcbbab7", "value": "T125042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765040598, "uuid": "7b656515-df7e-4b22-83fa-434abe5dec00", "value": "3072:O8/WsWhjlvbAmfkIaboVSyckpj/HS0BpCi/hJjogM/REC/HV6:O8/2lvlcIaboVS7kVdBMi/XMgM/REC/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765040598, "uuid": "a3ccf79e-06c6-44e3-b258-24af4f44c4fc", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765040598, "uuid": "ef3acc39-23a9-49fd-b4ae-5bfc42064593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765040598, "uuid": "321aef76-420f-44e9-be29-8128f844a657", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee576cd-d2b0-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765031781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031781, "uuid": "05529f64-4629-4dc3-8f7c-79c1394034f4", "comment": "Malware payload (AgentTesla)", "value": "bb9570c7fb369e048d133bfbb442e46f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031781, "uuid": "e5620848-618c-4b6a-97eb-c8a6708e7993", "comment": "Malware payload (AgentTesla)", "value": "2f1e984583a713d71d6c059181530da8ec634f45fb6a63846c9fb4a723a7c050", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031781, "uuid": "fc7c882d-bcad-4165-bbcc-87fb7ea5cf60", "comment": "Malware payload (AgentTesla)", "value": "1a42d1aefc5557b805e4305aeb8d210d7a2735c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031781, "uuid": "3f9e8f50-da75-4a6a-b1a4-a33eb12dd880", "comment": "Malware payload (AgentTesla)", "value": "20610b70bd051e2e50f7cd2cf8af8c9cf1dc636ae6b6089482f88af6322cf702daf8dabf616d264e0897a6fc0584b10b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031781, "uuid": "de0f8c06-c9e8-43b4-a3f6-591397745a51", "value": "T1C2E423D25A809D21C5517330C836CD60867838B69E27773F836EFAAF6871383ED1675A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031781, "uuid": "e4be2373-fe02-4d46-96c2-ae460fa54ef7", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031781, "uuid": "92dade58-9616-4131-ae37-6a092a5f9b95", "value": "12288:Oz7hU5I5yuNHIgzSFKxWltRohBfSTso93UkXsvvxBNhLdRAxXfMz9nUt4TUz7EOS:Of+iN57Gtene3/6XB00zY8OybqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765031781, "uuid": "291e2c60-2729-45bd-8492-66fb66f770ef", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765031781, "uuid": "3acab2ef-0de2-43fd-89ad-2bab29bb633f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031781, "uuid": "724c8362-5f91-4fd6-a2f5-f8527cf4e61c", "value": "URGENT !! RE RE LCL FOB Shanghai- Nhava shevaTWVD82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da68120-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050113, "uuid": "605c4d50-95d3-49d1-8fdf-3a34d278a163", "comment": "Malware payload (Mirai)", "value": "957c3e7b0f1e2e96b0a0205aacb260c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050113, "uuid": "69191299-8738-4f07-9324-23ec2cfc89ba", "comment": "Malware payload (Mirai)", "value": "2f87e2e7c230cec54ca0246266e49c40159937252e7869de3ce2f2e6d404bd39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050113, "uuid": "9298804f-578b-47fd-a0fd-d7cea4b69252", "comment": "Malware payload (Mirai)", "value": "effab986ef319c53b7d631419306a98100696608", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050113, "uuid": "d1440cd0-5cea-45ac-8ca1-8a2c33c466aa", "comment": "Malware payload (Mirai)", "value": "e66c521f58ddecae5bdc0ba12734a65440552d0754844a1804bc49ab2800be37aebb48a2ee96081ab85b56b2a19f3d61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050113, "uuid": "ef4efc7f-b7f5-438f-9bbe-4dbd253d0744", "value": "T1C8043B46EB418A13C4D227B5BBDB424533239B64D3EB730699287FB43F86B9E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050113, "uuid": "6822aa98-76f0-4d27-850f-19ef80d5da85", "value": "3072:3oxXy6fUr+G43ayYR+fZMbWC7R4QYp/Fd37rSFbyM/9qpmCOU:4xXFB3ajR+fZMaC7WpddrrSFOM/9udJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050113, "uuid": "369a5fa7-b871-444d-9f39-d43745a19a26", "value": 177915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050113, "uuid": "09f4da58-cbd1-4026-900b-e7a90575519a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050113, "uuid": "de9801f6-f079-4cfc-b663-506f58a1396c", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecd64ba-d290-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765017822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017822, "uuid": "edf2d121-3561-4645-9124-a2c5030c9953", "comment": "Malware payload (Formbook)", "value": "2fd15668340cc6a8e0f731f7fee77524", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017822, "uuid": "5ad929d0-aab6-4c81-85fb-d511669839a7", "comment": "Malware payload (Formbook)", "value": "30369b84528c60d47c250d4e3d4fd72f25321a2c34fb23cc0d971c436ea67005", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017822, "uuid": "6c7d3eb8-4154-4a87-98e9-39502d9e1781", "comment": "Malware payload (Formbook)", "value": "1e1b8775c974b18161ff4a68bf8cdcc19b5c94a9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017822, "uuid": "fc2c2cea-eb11-48a7-a14e-8f68a5ebf55e", "comment": "Malware payload (Formbook)", "value": "c9bb405e7a5b7030b6bc8eb6688228ce956c56f64dd4405700ff90a211d022be5a1f6629caaa36c8d6acff47f632ef48", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017822, "uuid": "742081f1-d243-48d4-8457-a91b64d0330b", "value": "T1E0B42387F6DAAA6A910E707D07FA3F508AB735A774F024A427978019C03AD2B71C5733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017822, "uuid": "7b6691d7-7809-434b-bcd7-0cffb7ea5354", "value": "12288:Y36x6MkPpRISu/cI7Vb3HCbAm2O9N1wdirDdtBENG:OyGPkcIN3eAmNSdyVuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017822, "uuid": "a4e8ea45-6de1-466e-8818-5f81af09b041", "value": 516559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017822, "uuid": "712c86ae-0c8b-491f-89c1-2c130b509414", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017822, "uuid": "25105034-0785-4d06-8b9c-4c0a9e1675df", "value": "Sample Specififactions.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ea3c75-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042204, "uuid": "cd5f581f-d62f-45fd-b8c6-4dc8e4c7b5bc", "comment": "Malware payload", "value": "2bd96bf901218fd0ae75a3b7fa8f1d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042204, "uuid": "f399dcbf-fe16-4384-99f8-666018c0740a", "comment": "Malware payload", "value": "309bd7b7aa737ede834e498e177a9e0b44b4b46a8666b8182ddc0a4aa283494a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042204, "uuid": "d0d338ef-4662-430e-84ba-37436a3b4b02", "comment": "Malware payload", "value": "239d6ca6ea132ea5d6241aac3bddbde3cd5ac200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042204, "uuid": "52157977-5127-48d8-b35b-41265026cdac", "comment": "Malware payload", "value": "83b93e214662171be4367801b51a2c4004f6054d76b3a2824b3b7cc5ead2a1c58eb4a6d1e3830090bf02eebd7d6559fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042204, "uuid": "564b88c8-6d60-46eb-ad8d-f7aa2f3cdbae", "value": "T10D858E07F2A191EDC09EC1B44347AA33BA36B8890621B9BF17D55B703E6AF514F1E709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042204, "uuid": "668ffde5-5432-43dd-8e16-186cab777d11", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042204, "uuid": "f0b773a4-feed-49a4-b8c4-7834fe89c84c", "value": "24576:j9AtIFCL6vGvkMCoVciGSytugAx9N/HEWf3fCeMc82I/SU:j9AtIFCL6uwiGSytzS8Wf3fDMc82I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042204, "uuid": "69e148c2-2279-49e5-aa48-cc507dc57c9e", "value": 1715200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042204, "uuid": "2f2780f9-fb5a-4085-a29a-f9385b93109e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042204, "uuid": "06ae9252-4db5-4243-b988-b7980958cd7d", "value": "enc_orig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ef697d-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061243, "uuid": "f067f1b8-50d6-43f0-b3f8-35511996d1a3", "comment": "Malware payload (Mirai)", "value": "b86d4c1c52d641fb4cf232d8042ca53e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061243, "uuid": "50d84fee-7809-4523-b5e0-ccd94bb9f647", "comment": "Malware payload (Mirai)", "value": "30cc66b09e053f890ced24e9c409dda9b618dd9eed91c54de0e20a3921fafcc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061243, "uuid": "40ae9ca7-a8e8-4ebf-8fa7-bd0da37f25ba", "comment": "Malware payload (Mirai)", "value": "1bd3f8b2e169165260230effb8a3882270192e19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061243, "uuid": "9ce7af7b-b9ff-4b91-9739-c7a88bc055fc", "comment": "Malware payload (Mirai)", "value": "10dd81d6ddbf2b22a61480a48efa0caf36d9397edbb6a7fff51e6fe7d1e82406b4a3f1aef27e0350cdb12ddc3101e2fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061243, "uuid": "808dfa4c-3422-4eda-9336-716482d9be59", "value": "T17803F8D1B8825A67C2E023BAF66E518E3361B3A8E2CF7317D9211B047B8951F4D67F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061243, "uuid": "a5bf3120-ad36-453c-a193-e2db32375dfc", "value": "768:TKiNOVX8ggqcqVATXcPlEHTU13FUHnsvj4i0ZrltGMkrA:5MXTgpqVeTUXNv8pltAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061243, "uuid": "faa85d5d-bd7e-4c98-8714-8365e90a6e51", "value": 38772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061243, "uuid": "a3d6e5d8-3b66-4f54-9fff-239f38a18260", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061243, "uuid": "ad9eb4d0-1d66-41e2-b3b7-d91c6723f6d3", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bd73ba-d272-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765004868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765004868, "uuid": "12d31137-a3ab-4a8e-b6d1-7b0470ca4547", "comment": "Malware payload", "value": "82d47a96b73675759e942a0c238e8acb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765004868, "uuid": "4a74af17-391f-4766-8499-0e677e7c0ce1", "comment": "Malware payload", "value": "32428ed459777c26d68551f20c9c5aec1925ad0ce3a7d257066d92418b59c861", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765004868, "uuid": "bbd0c581-b90b-401b-891f-7eaafd9e709f", "comment": "Malware payload", "value": "ce5a27aad278bc6cde9f938cc86c40e124c6f441", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765004868, "uuid": "83ed4c9c-e0e7-4e47-b751-4f37b6af8a1c", "comment": "Malware payload", "value": "ccccf6a012b1255fc09cd28b47d894489dada027c2b3f276e5b6ff7eb9996705c6b0f5314367fdc6c75a96a6fb401502", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765004868, "uuid": "7f75c150-919f-4204-8e91-5cb3fb59ef4f", "value": "T1AD1733C03335372C014B426EE44A4CED999E2092CBBF56AF5F59FD0984AF52BA9D05B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765004868, "uuid": "28c65018-8e1f-494f-b27e-2bf0fda9f54e", "value": "393216:HIV/qN1/qF8JMdVjaPfISHUaVtJWULnEC/ZOy2fDmILAssUPXGfXFwr+3aBM:ai/S7dw4BsJdjECh38DP3PU3aBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765004868, "uuid": "ff0d4fcc-73d8-4dc0-ba77-4611174dd856", "value": 19458191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765004868, "uuid": "ddd24132-01b3-498b-b657-ded4b8f46195", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765004868, "uuid": "e8cd63fb-9f5d-4571-8874-a03fdff25383", "value": "latest-SetupX64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd77c8c6-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049844, "uuid": "cde6c065-2b0d-4a89-b241-be6e40d2b965", "comment": "Malware payload (Mirai)", "value": "202088dd1a59f5c636c3036b39af7fbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049844, "uuid": "254df7b4-e1f0-442f-86c6-2da32ad552bc", "comment": "Malware payload (Mirai)", "value": "332dbe313ccb71e465d77a0f4de540881e13b4227c5496cf6ebb0e608b8a08af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049844, "uuid": "4fdfc67b-c689-46ce-b4c9-2ade57e88c0c", "comment": "Malware payload (Mirai)", "value": "de72c86c2180261806e7a01c73f74cc51a8be54e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049844, "uuid": "03d0507f-4759-4694-bd28-6387114cb7c5", "comment": "Malware payload (Mirai)", "value": "e7c8c2f23ca6448d53fb8bf6db20d7f80e2838516c0ab3707d17944bf6599a80bea22b6123e0256975b2f96b6f339cb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049844, "uuid": "7a71e7de-6d54-4120-bb87-17e5c7067b6f", "value": "T106E45B55F450DF52CAC6267AF6EE82583323037DC3DAB20A951887383BD697B4B3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049844, "uuid": "e26f9be1-be89-463c-b3f3-7adb69e23bec", "value": "12288:tjrOc9Le8CNjGq+Oi6Jk8FNHzZj9K2/MN/dLjFlZ8dbkOMP/o4:tjrNlsriKsLBWbD2/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049844, "uuid": "12bdc43f-920c-45c5-a6e7-8dd9f2be097e", "value": 714736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049844, "uuid": "79b128ab-db6b-4607-a3ae-d58b32004815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049844, "uuid": "123d42c8-b9f2-4bd1-983d-542c9ab1302c", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7468e7bf-d2c8-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765041883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765041883, "uuid": "a3f36d41-61bd-410c-8ea4-a7c89fb5a6a7", "comment": "Malware payload (QuasarRAT)", "value": "a13d970993a6d17ba70c21b7e825a661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765041883, "uuid": "d9b04d9e-b87d-4d65-b3eb-4cbede6e8957", "comment": "Malware payload (QuasarRAT)", "value": "333895a4615ea1dedf4f0cc796d912ccec7384c7157f9e3bda2e6d27e392a9d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765041883, "uuid": "01a054e5-ea75-4390-8a5c-9a0066521905", "comment": "Malware payload (QuasarRAT)", "value": "ddd7912c37aebd56edcc935b362047f8de8b61bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765041883, "uuid": "225f7381-6162-49ca-ad26-14e872cdc191", "comment": "Malware payload (QuasarRAT)", "value": "d2ee5b75ef5531b19c1c3f69b981eeb726476b6c484ed0e45a4fb1dc054dbd203d731af6240a1187c219d542084ca41b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765041883, "uuid": "939b3d2f-a7b7-418c-b3b7-ba7046bdbea7", "value": "T12CE55A143BF85E63E16AD773DAB0501663F1FC2AF363EB0B6191667E1C53B4058026AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765041883, "uuid": "56990c02-e163-4129-bd0c-a499de73129f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765041883, "uuid": "c6f6e8cc-55c9-41b9-92f6-239d1b3188df", "value": "49152:KvulL26AaNeWgPhlmVqvMQ7XSKBDirUMffLoGdETHHB72eh2NT:KveL26AaNeWgPhlmVqkQ7XSKBDirD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765041883, "uuid": "68dac61d-a4c3-42a3-a908-4c66a23b2b3c", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765041883, "uuid": "27d43915-b970-40b9-ac89-1feb463d2fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765041883, "uuid": "72491a6e-d038-489c-8bd3-5e801a4b9783", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb4240d-d291-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765018251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018251, "uuid": "069e97fb-a063-4e9b-afd0-7631d7b2135b", "comment": "Malware payload (Mirai)", "value": "40cffa12843faf2872eec2ff99d39a12", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018251, "uuid": "d94e2536-e698-413d-a3a6-2d68486b32c7", "comment": "Malware payload (Mirai)", "value": "333f533c9a5b29ea3a872745e42cebf9c1baedd7dfe4b2c19ea6fe3290181d61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018251, "uuid": "6c327c4b-89f1-4f6a-8b93-22912e9ac06a", "comment": "Malware payload (Mirai)", "value": "072a46297cda99b9d7d8366da83e9b2cfb6da226", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018251, "uuid": "1575e619-69c7-4bf4-aca0-11c6a5d90706", "comment": "Malware payload (Mirai)", "value": "d608c7b6b1c354ddef3c8d8f381d3df9a50b2db51a52245010faf524bb7cfd9669587011124b1f4c2ab570e1a7d2fd66", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018251, "uuid": "5d8807af-0ae4-4af8-94b8-6510fa2b9f9a", "value": "T16A11A5F9F6334066F54C957FFA5D61AC298B3C2E30A9667920D6F9924DAC45C3238233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018251, "uuid": "a219273c-77d6-46e1-8d80-815442124ec6", "value": "24:fCl5NrjjTC+0C1ZgCvK5NrjW8b2RgXyvtK5NrjA:fyddYanZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765018251, "uuid": "56120189-aec5-4c0f-a0ec-764558363a16", "value": 997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765018251, "uuid": "742ef894-ec65-4ad1-a526-75710ce3bc95", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018251, "uuid": "01141247-ce95-4af2-9d05-09ddd019f8cb", "value": "ppp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b454ae66-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011926, "uuid": "d12e097a-0757-4fb9-86f0-a52f8271dbd3", "comment": "Malware payload (Mirai)", "value": "5b2095171365bf8355a27996394f7d5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011926, "uuid": "2a26e6e8-c4b1-451f-b41f-1ba6d3c8ab8b", "comment": "Malware payload (Mirai)", "value": "3392613430669b9a59ffa18d6e80f07b617617d27473e9ddf4e245f96978cad7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011926, "uuid": "74cb4de2-6b92-4aab-b327-c9f9284d1a8a", "comment": "Malware payload (Mirai)", "value": "b84f09b69806d32ea822065a72a3df5b4313a24b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011926, "uuid": "42820b3f-d06c-4453-bb75-9eec8994212f", "comment": "Malware payload (Mirai)", "value": "0ee36710d2bd286ee85ce7b541ec679d651e6f97f630875183fb38ba6034dadd9c117aa6203591fdcd27d5370c514dda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011926, "uuid": "cbaa347c-adf5-4597-bb15-8e52a32ecd15", "value": "T1C0033BC4A503DDF4EC4506B92037EB329B76F13AE1BDED9BC395D9329882601E6062DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011926, "uuid": "894a186c-df1a-4748-938b-60f4a9875cc2", "value": "768:Jb89u9BaImxdoU2GFABwu2hzbOEyA8by0kfaw/JOGyMwyse:Jw9WaImxdoU2sABwu2ZK/mtfB/JOGyVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011926, "uuid": "052a2b76-a7a6-41c5-ab49-7bed99299654", "value": 38528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011926, "uuid": "db4a9c02-86b0-4686-aebc-58684fd728b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011926, "uuid": "374f732e-97cd-4a86-bfac-d5910a2d8d0a", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a01475-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048942, "uuid": "dc07103e-dcc5-4c59-84c1-59c2043dd374", "comment": "Malware payload (Mirai)", "value": "916fdab3341a95bd86a8cbfceb6746d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048942, "uuid": "37887277-7645-4f86-9ce0-af2926e20dad", "comment": "Malware payload (Mirai)", "value": "352bf442d8c0a7aa45c00c1962a49ba28bc71514682dba933c08cd81e1e41c96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048942, "uuid": "61aa1b8b-ab92-4bb3-b38c-e8e50dc48cae", "comment": "Malware payload (Mirai)", "value": "0625ebb3084a44ff0a777da4e0393ecd8269b537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048942, "uuid": "f163b9a1-3cec-4229-ae1d-bb6f4468d007", "comment": "Malware payload (Mirai)", "value": "5ae348d33554aeafac908084d84a2fcdaff997886ffbfc886ee3c12c6d9c9e8e4fc8775933aaec43349c8ee8e1dec9fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048942, "uuid": "549e0ede-ec36-4564-a1f4-a323ff935351", "value": "T15AD33841B9829A27C5E523BBFA6E018D332563E4D2DF72178C215F217BC681F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048942, "uuid": "8c7c69e3-ce70-4219-82ac-2f81aa42787c", "value": "3072:8nFif7apx6XS+kUgpjWX60CMgcWOgc6ZzyQSR:8n8ZS+dQWX60Cdsgr+QSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048942, "uuid": "fcf8e932-dee6-42c8-afe5-07247948b714", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048942, "uuid": "831893e6-51fc-4dae-bb51-8243d3594a3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048942, "uuid": "8a4727cb-b692-4090-8ade-218a3206c4e6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26df1044-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042183, "uuid": "539c7de5-11d0-4a66-a4ff-030513394204", "comment": "Malware payload (RustyStealer)", "value": "7581ba60eb121a0ca0499a8fe8c3bdc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042183, "uuid": "dec09ff3-8089-4008-9231-b1984c9ddc8f", "comment": "Malware payload (RustyStealer)", "value": "353800a0934e6de5d02f660fcde2be3e3b3d3bb70bcff3a157355c77a75cb935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042183, "uuid": "26500941-2e19-40e5-8a3b-c15e3b0d312c", "comment": "Malware payload (RustyStealer)", "value": "e60ee8e9516b1d9595d026c0ae84d3f93db0765e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042183, "uuid": "f2668ca5-cdb3-42b4-a936-d734516faf44", "comment": "Malware payload (RustyStealer)", "value": "81220e8000c4d7b70d0cb4b9cbd9d4fae013e3c370478c216b321e50f92ad03084e197ca7fd64b75dd8e46c5dd9cf71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042183, "uuid": "ea8babac-c2dc-4167-bf97-c61822672b83", "value": "T1D9159E1BF695A2BDD19AC0B483068672B675B4CE0621BDBF11E1D7303F9AE611F1CB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042183, "uuid": "59736f10-f78a-40d1-861f-0eafefdbd20a", "value": "87f0863ec927249773659ca301d7b700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042183, "uuid": "e5eee1f3-3141-4756-87a7-5e8ee712bfa2", "value": "24576:dkm/LsyEeiePlw0Uy5/88kWhyY9F86O/:Km/LsysP9y5/RkWhyYj86O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042183, "uuid": "76d02ef1-4c95-404d-883d-19b428c8dae3", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042183, "uuid": "98b99d04-4b6d-497b-97af-f90e32aded51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042183, "uuid": "b0bc035f-18fa-46ea-9599-c2725b81dc3a", "value": "dec_unique.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3268b8c0-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043490, "uuid": "6554856f-afa7-4bd7-ba68-ce2f025f7c80", "comment": "Malware payload (Mirai)", "value": "b8fda2f9ed6da2b3c4f6ab1f9f4ba690", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043490, "uuid": "48ab02a3-10e0-4a41-88e1-1b593f6b4257", "comment": "Malware payload (Mirai)", "value": "35e36bff50906ff4f07d4728ca65dda0883785b31059cf13fd7e156977210ae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043490, "uuid": "d855b2d3-fae7-49e2-8650-93e3d0728f70", "comment": "Malware payload (Mirai)", "value": "a01404ac91c2ea13bc0da4d68956f1ba31c226af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043490, "uuid": "4d1ac5b0-5f50-40a4-9c42-c8a2cf9768c0", "comment": "Malware payload (Mirai)", "value": "527ca66b182570650c32a5a7ac18d44984c564925df6e8a62d05aa2522a9bd1f28313ca10fe8407f5ca46cc46f50af40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043490, "uuid": "41586207-9a05-48f8-a64c-86ac852b7755", "value": "T1BA93B81E6E219FADF769C73047B78A21A75833C627E1D685E25CD6002F6034D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043490, "uuid": "0c3ca1f1-6acc-4782-9570-a9466f04c916", "value": "1536:KloXJI3TfgvW38oqXXgLAHw3AGh6zeglH08kYf:KkJIDovu8xwLH3AGka89f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043490, "uuid": "47fac535-6df9-498e-9316-049b46ffe018", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043490, "uuid": "52635cd5-91f8-4892-af3a-794810ab6790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043490, "uuid": "999d5b2e-d883-4e6a-90a7-573a2932ffe1", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a42386e-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049194, "uuid": "406dc745-9494-4ef7-9fc0-9db081de6630", "comment": "Malware payload (Gafgyt)", "value": "8a62f1c4b55921d6209779796c50c6ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049194, "uuid": "8d3c56cb-f880-438b-923e-2b0e11521f47", "comment": "Malware payload (Gafgyt)", "value": "3631b17e11c957f5817773d55d2b6bb17be668252648728ce2c392ce2d90755d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049194, "uuid": "cc3c7a2e-6363-479c-84ac-fe9a9ddde14b", "comment": "Malware payload (Gafgyt)", "value": "24aaf8538bded91b915bea848f1ce9fce0412af6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049194, "uuid": "c6ef97b9-0e3b-416f-a807-f4d50cf4c4ea", "comment": "Malware payload (Gafgyt)", "value": "5e0f82550ca9a92c154939dd3453d4caacff9f9021cdb0b6207fa0e22ffe92a298ea2334f9d7523beddb2122978c6321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049194, "uuid": "f904bd74-2220-4d3a-9f4e-8fbea63a3f19", "value": "T1E9833B01E643C6B3CC8307B2029BAE665931BDBA0E2A9F45F35E7DF46B128C47116B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049194, "uuid": "638a206a-1624-4f45-8701-e7d3260df334", "value": "1536:yrJkUd4N/BKFuWuxL4hWL8D/G0TVmF+wVOz+sXcfW7k:okUd4hBKFFui0gzzVmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049194, "uuid": "f8e46d81-d383-4398-9ceb-c659c0560b04", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049194, "uuid": "7bab2dbf-3350-4323-b3cb-500db32c4e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049194, "uuid": "250d27ef-f6d2-4f09-a9cc-ca576a2410da", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9c8157-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048958, "uuid": "2df8c1d1-412e-448d-b887-7705769d30cd", "comment": "Malware payload (Mirai)", "value": "ced833d246296b9a5db2a66d5c4ff3a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048958, "uuid": "46b178a6-a091-4bb9-ae03-5429583a176f", "comment": "Malware payload (Mirai)", "value": "378ad2196c0f3b2331190b5eda4463333327f20139a82fd6b1e794b5671c3711", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048958, "uuid": "2a1c5b57-939c-4c07-90a9-73c891f4f716", "comment": "Malware payload (Mirai)", "value": "bccd7940813dddcdd3af3b70c2d8ebd07c981b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048958, "uuid": "6fcc91e4-e443-4904-87b7-5ea2fcff1dcc", "comment": "Malware payload (Mirai)", "value": "7324f0b0ef610470c0865d46994b89bd18888bcb95ef81aa7a941e20d5e7ccefdaf7b9c2636eb0cdd2e43b43a8df37ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048958, "uuid": "e8f32c23-5cdf-482c-8478-4ff007d4bd37", "value": "T130D34B46EB808E13C4D5177ABAAF41493322E754D3DB730699185FB43F86BAF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048958, "uuid": "3b2ed239-c158-4f7f-bdb0-ed085aede71b", "value": "3072:ho9lg+zhz3sJu1NHLL8XmiC/glLCZTrHHlOM/9d0Yj:W9lgahz3sE1lcmiC/g1CFHHcM/9mYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048958, "uuid": "02c8bb5f-efd9-40b8-86d9-e4dc46421af8", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048958, "uuid": "cbc7c960-ec67-461e-acd9-f5295d5cc224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048958, "uuid": "ab0288a9-7de0-4115-af95-0b1cda89f9dd", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1b8959-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049172, "uuid": "0dba7684-94b5-40e7-9277-59477f1b5fe8", "comment": "Malware payload (Gafgyt)", "value": "9d8cb548b1b58eae859cfca5ee9fbf07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049172, "uuid": "fc4d767f-3253-4149-a386-12820ad894a5", "comment": "Malware payload (Gafgyt)", "value": "37fb3b56f920f1885091d45aded5b0dcfa74360fd760062f0c1df98d8047746a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049172, "uuid": "e66e95b9-9c71-445c-84c8-c112f658f3fa", "comment": "Malware payload (Gafgyt)", "value": "5bc7ecffa2d926d09619b3f5b7bb6fe6eb9988f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049172, "uuid": "61d91e66-cf9a-4607-b37f-3e7968b8e55e", "comment": "Malware payload (Gafgyt)", "value": "3bfa7d6517491290e6025acad8ebc2673c3629a8dda5bd7ff14fee5a2ea1ac2469a1fbc41f1ea213b311128b5e4dfac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049172, "uuid": "1c00d3cb-7a36-430b-88f0-ee1409197c3d", "value": "T122A3F796F800EFB6F40AE77604D74B24B670BBE54F931622721739A6AE721D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049172, "uuid": "625b581a-2ecc-4b4a-af0e-9c183b2b248e", "value": "3072:hL0y/zOVISLfvyyo1X8fNpqOkNmuxVqDr78fz1e:hwszOVIAyy681p3kNmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049172, "uuid": "352f8645-1921-4bcb-a0ca-1d1ed86e7a00", "value": 98931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049172, "uuid": "973babe6-76ac-440a-8d0d-95a8145acbf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049172, "uuid": "7d0decc0-7b41-47c6-8746-a5418272e934", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abb6512-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002407, "uuid": "0ad8dab1-dbf7-4dea-8399-576682319805", "comment": "Malware payload (Mirai)", "value": "dbe1bea2f85edb2fae297639d7478c9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002407, "uuid": "1e784917-cbd7-440b-b655-8c36948d0e67", "comment": "Malware payload (Mirai)", "value": "38081cd6dbbb7c502ca12350ad72026bc3ef119db91233bda78773d6dbb2af08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002407, "uuid": "da27e1bd-d368-48df-b40c-3afd2f8d73a5", "comment": "Malware payload (Mirai)", "value": "500b08ec8c9746abd47ef34ccb0cf50d052b7cad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002407, "uuid": "de7881b6-99f3-4bae-8aaa-9458d0e5ad47", "comment": "Malware payload (Mirai)", "value": "f0be979823d8d8669d62506ef5b5ae423da9631f1f51822eb8ffe32f7ce5d4413eadbd1b830f68e91133e74a19df12a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002407, "uuid": "6b08406e-376b-4340-add6-6f70abc6a6b8", "value": "T172244C46EA418E13C1D3177AFAAF4249333297E4D3D7730699286FB43B8765E0E27A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002407, "uuid": "2688998c-50bf-4e3f-9085-644470107998", "value": "6144:sAo+KMO1dEMtQDfttLDLa5oDh5rjMejtYftLKbX2kM/9KuWm0wNtcNB7Y:fo+KMO1duDTLaqDh5rjMexYsC1/cXm0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002407, "uuid": "e7d9bf67-7fa7-482e-b361-a2dbfd39c020", "value": 215243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002407, "uuid": "1ced038f-02c6-40b0-9aa5-3f37cbdb9fde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002407, "uuid": "bd5110ef-5a1f-4137-a0ea-e13a34eff714", "value": "colonna.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89f1f4f-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048923, "uuid": "e76d8c86-77f6-48eb-a7db-5600155a6538", "comment": "Malware payload (Mirai)", "value": "1a8a7b8b70c91b6d5787dc5c5e913505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048923, "uuid": "f834cfe7-4b32-4404-b0d6-655c6375ef88", "comment": "Malware payload (Mirai)", "value": "382bcf10c7ea53b2ef9b9cf75b5a648af31b394d3cf95011bc0d33cd25a689dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048923, "uuid": "688a5323-0e6d-4bb6-a153-5b85f0ed4cd1", "comment": "Malware payload (Mirai)", "value": "06a011fe6f4c9cf3db6859bcb05c04deed597c68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048923, "uuid": "281b53e2-7b2a-45e9-9faa-eb731c2019f9", "comment": "Malware payload (Mirai)", "value": "265a7cb6ec4c0edfd91c961935aa19c239a77d0312684f15bf4c72d9c3b6d352cabb5dbe9151852bb2e99b12d864cc2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048923, "uuid": "69a6aa4b-1c0a-4a7a-a8bd-4c673abe9fe2", "value": "T176F34917B4C084FEC899C1745FAFB536D872F16D5238B26B17D4AE232E4AE305B2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048923, "uuid": "9ced30d0-4272-4a44-b148-a47abc978ff2", "value": "3072:GtqqtTjs5+hLqI5IufhyV+13X7cBa2yRZ+uD/QPr3kdeiiu+:GIqtTjs5+hLqSkalRFQDOeiiu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048923, "uuid": "4f4038d1-63f9-4f8c-b844-30dc1c44ae2d", "value": 162440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048923, "uuid": "c59e8bb0-0f1f-4ba9-abae-aa8e79e3d61b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048923, "uuid": "ca1ec3ef-b9cc-4564-abaf-bd63e4932fe3", "value": "jnaudsbsgdibfhfhdhdhfhf.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffab400b-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049848, "uuid": "0703f8dd-02fd-4c79-a4f4-5784bf8b8c82", "comment": "Malware payload (Mirai)", "value": "474971a88f8904d489f65aec28cee3f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049848, "uuid": "8ea8e173-2f76-46dd-ae95-25bb944cb981", "comment": "Malware payload (Mirai)", "value": "38c63eb0bc02a519e0a42e5a27825a3e071de2bf2a43d50daf1cd893b2658a79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049848, "uuid": "9e7f0369-39de-4d58-8b91-e973d0ce56bc", "comment": "Malware payload (Mirai)", "value": "bff7dc09dc747f5805bfcc725f9fbe4ee406b123", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049848, "uuid": "506f7dc7-dc74-4240-be6b-5092669b890d", "comment": "Malware payload (Mirai)", "value": "aa1f0b6e9bf3c15c554502e5ea2ef6496ba3f18d659c889dc5208361dbafb2b030e1800a75007d2f62a4f973416bffa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049848, "uuid": "f7dadec8-d97e-4dd2-be91-7d5d98c68e1a", "value": "T17415AD47BAB298BBC053C234879BD6569636F05512232E2B35C846343F2BEB44F1FB56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049848, "uuid": "73d551f4-6676-4b18-b71c-d3eaa09b2ec5", "value": "24576:Usf4s948VGH6bq0ghJNu1se6VxQ3QstN0Hg:Um4s94n+ghboshHhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049848, "uuid": "ef3ba3bb-c556-412f-b56b-a97bd30dcd15", "value": 941232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049848, "uuid": "af9b5aa4-5a32-4d1b-8e8e-2e0ed7f80464", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049848, "uuid": "a0fa0aad-07b9-4b18-a02b-b6284d0313b2", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87572c7f-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050075, "uuid": "3f7d5bd5-f903-46af-ae1b-b18594607a82", "comment": "Malware payload (Mirai)", "value": "8790a9491faeb07dfe01ee6cd4ffd748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050075, "uuid": "c7ffddda-4394-4cb7-bb7f-12fb6c342a2c", "comment": "Malware payload (Mirai)", "value": "38c706c7f53415b957a10b9602de9a31418684e5ab213f26e35af857c7790e7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050075, "uuid": "c89ab0b9-6eed-467f-91f2-f7dd8cf76ed4", "comment": "Malware payload (Mirai)", "value": "a5a5f4db39c959947000c6205f439b4d3ee1e7f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050075, "uuid": "562d7456-2f10-4944-b73f-27a735d95248", "comment": "Malware payload (Mirai)", "value": "b500f50facb71858ee8158347855ffde31d24ce7dbbb95cc24bc6eaaa18f7743e295661a0cf698ab450806f79643acbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050075, "uuid": "fc7ea519-0727-4d03-80e8-849bbe087e3a", "value": "T163C39D87F78B14A0C4624AF013C71B9D6E53B212CE5FE8E3BC1D663B5A7A4DB1916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050075, "uuid": "6faa60c4-e600-4d99-bff0-93abecd959e9", "value": "1536:A+iIpkmI/I1OHeMCcuemudrzB2TKv+XdcBOly/Qe54YkxP/0gw3Ek/LWy:/pk3/4OHefemudXBcom2BOZe54YZggq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050075, "uuid": "2d672655-bd55-4088-8d4c-e26c5f0a56b3", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050075, "uuid": "ac103be4-c159-45bb-8626-69a1c0a9ad42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050075, "uuid": "726ed532-3937-4fdf-bd80-dcc5ac7152b4", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1639c9f8-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042155, "uuid": "445d98db-4350-4b76-9697-bb9c2c7fd7a1", "comment": "Malware payload", "value": "502280fe789ee92e0e34659155b03838", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042155, "uuid": "d7118c32-0c84-40c0-9988-049690f3dc44", "comment": "Malware payload", "value": "3953a9216581adbb81e5761646c5b6dee88929c079913403cf717b566db8256d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042155, "uuid": "218fc76e-6ca8-4043-8212-f1719e354799", "comment": "Malware payload", "value": "4099a5236c65c5cf0c37a287dc0ceddebcab1ada", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042155, "uuid": "39addfab-4235-4c73-9ed0-8678cac6c06a", "comment": "Malware payload", "value": "09966adba75c0c1f7b43c55022a3e3aaf37a54017d8d7684c398934751588b26ab1c4225bd7e4aafa076cb3ce5446164", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042155, "uuid": "8dc1310b-49dd-43f2-8c63-e0ff3890085c", "value": "T13772D80633F44254F17F6B3969B201694972FC7A9E31EA5C0CD9506E0D72B849F60FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042155, "uuid": "2b02b5ae-5ab8-4532-be1b-43516817a22b", "value": "384:XaM8+lCO/5vgQrMb+MZl98Zw9QOlg9cI3STt9fqKygOnQ:KMtnpU9DQi2KyznQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042155, "uuid": "a8a2535e-4832-4c83-a9ee-b01a8441a1d5", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042155, "uuid": "35aec5a2-50ed-44ae-88e1-307d8645ed07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042155, "uuid": "182def3a-8208-44e5-941e-522c7f8e7091", "value": "agent_fw_x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7581b59a-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049616, "uuid": "2134a50a-83c2-4ac1-ba27-70c705745e0a", "comment": "Malware payload (Gafgyt)", "value": "bf8fef6ba57195ebc0b6b5c1ba5c8e25", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049616, "uuid": "9d0f286c-ed6b-4f55-954b-934c78d2decc", "comment": "Malware payload (Gafgyt)", "value": "396f4d346bac8bf9f5aea36155ff55980a9528f1c57b0a6d76107cd6e8d3ad6d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049616, "uuid": "95c0ae11-2f26-45f2-a6ad-2b4cfa94e3a1", "comment": "Malware payload (Gafgyt)", "value": "1008753e78668587c8cbdb44599ab7105cc26cb2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049616, "uuid": "3382876c-394c-415e-90dc-c3f6adfdb998", "comment": "Malware payload (Gafgyt)", "value": "3b2c37d0168ebd1b025820ce317a33a6e30a67e869ea7f24d50a84b6b0a24fbfedb39e0ad31dafa55e834e64cba6b204", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049616, "uuid": "11ce9da9-d3c8-4284-83dc-49970a4a2df4", "value": "T1302107DA19B309F7ECA7D4173379C81934D4A99A18CAAFBDE8DC75E5058CD087821B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049616, "uuid": "654516ba-e3b0-47be-a2a6-caf4c94bc9d4", "value": "12:q0FZQAeJo0FZQAlZJo0FZQAU1ZJo0FZQAW+ZJo0FZQsTHJo0FZQAkuJo0FZQAGZT:vyXyk9yd9ya9ysDy7kyF9y9ySyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049616, "uuid": "aa9482f5-2c26-4873-a09b-21a0a365dfcf", "value": 1357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049616, "uuid": "cc7343a0-0f6f-4c93-b5fb-3d7a15c519fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049616, "uuid": "cbddf50a-3c24-4aeb-9cb5-3e5f1e1a2e79", "value": "SnOoPy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a65ace0-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042135, "uuid": "1ee11b1e-32b9-4cb1-a40a-03dd0cfbc7a8", "comment": "Malware payload", "value": "a1098219f0aafd6015f28b3ba333149c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042135, "uuid": "b6c96b8a-3bce-4804-b0f0-7610bce50c7f", "comment": "Malware payload", "value": "39f6a1e340dbbcbb6285126eea7d2f083aec11a72f5bf7f82922abdfc556ea64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042135, "uuid": "bbc8207a-7b66-444d-9a5f-4b3c29044ab6", "comment": "Malware payload", "value": "a451fc8e1baa3fcf030dac44f14a2e7323052b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042135, "uuid": "09d8c737-db99-495e-b0d6-438972ef3538", "comment": "Malware payload", "value": "f705604a8c8ce58351282a7d7a85a32cffbe37c0a9682b8853d456cf1b0b68be792d6f18173facf0f23842725d8b89c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042135, "uuid": "d0576495-b0ad-4b8f-a8d1-a69f614ae7e4", "value": "T1F862060077F84754E1BF8B7969F3021506B4F9669826FB9D3CC9125E1CA2788CE61F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042135, "uuid": "29557127-9433-4e17-a553-0905bb00e69e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042135, "uuid": "32f341d4-4394-44b9-b805-9bac2838e281", "value": "384:EqSDzqfHGgAYkyk4hdR9VZwFj3hxY4Ww:EqSSfBAYXh/9cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042135, "uuid": "db262f9b-7c2e-4242-975a-cb64c0adcdea", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042135, "uuid": "adf20ee5-c786-475d-85af-4d812dbd0d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042135, "uuid": "2ce11231-8b59-40c1-9c30-637bb20649f4", "value": "FleetAgent_MemoryOnly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1289f1-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037495, "uuid": "4679c100-13d0-4d00-aa73-9bec4e88b975", "comment": "Malware payload", "value": "644321ca9abd32c5d8a6f5cafde61deb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037495, "uuid": "d7d46f16-dfc3-4523-8e9e-018f8e4d86d2", "comment": "Malware payload", "value": "3ab3cc3c0df02d723c850e712fa5f4a0de29f2addf2c50beffe222112c2baa38", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037495, "uuid": "2251aa96-2572-4f4b-ba75-ed1729d98b02", "comment": "Malware payload", "value": "f1a882d145272e998463596e3203a8269404ea01", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037495, "uuid": "b9c1bb78-66c2-40f4-be9d-273c396f45a1", "comment": "Malware payload", "value": "9cc2e37a38f26b0ed0f3dcef9bdb5b0f3063f5eb6e19b0fadb41c6b7cf4810c4f64d6d76eb52f8eda436d388f8004ab4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037495, "uuid": "be9cbece-fef2-401a-acb6-dd4f85b056a0", "value": "T10A761203F74E492ECDD2BA781953137166156CAC192092CB4A02F318BEB77E9AF16FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037495, "uuid": "e7dbf2e9-82b4-4376-9dd7-57f56d36503e", "value": "196608:whNXnA47j9kixuhA57I9iKyBaX7p43Sxexl:whrn9kix4A57AiKyIXWiYxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037495, "uuid": "a65ff3a5-939d-4b94-8977-163b15b8616f", "value": 7640329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037495, "uuid": "c1cd44c2-c8bf-41f7-80a8-82df866c8804", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037495, "uuid": "a1e743f9-3e63-400f-97b4-96feb470d9e9", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1673e4c0-d2f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765061482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061482, "uuid": "0cab172a-6e90-4484-9fc8-1931c471ac77", "comment": "Malware payload", "value": "808a0e65c647e2bc895548338e9ab046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061482, "uuid": "8c00a705-a37f-4241-aa01-c30ca7d12bfe", "comment": "Malware payload", "value": "3c4ca8d0d45f0f5389eda26d10ec230a37b7d9a4a47e19a1dcee7f8ea0d878d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061482, "uuid": "da2bbf92-4de8-4267-89ce-42ac33d9554e", "comment": "Malware payload", "value": "8c8d346f646116e4984df58ff49b0bb69b74e0c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061482, "uuid": "bc1105f1-493f-4199-bb80-54ab547e92a1", "comment": "Malware payload", "value": "f13c01bf5272d214c62c0b05c6dbfbd5fdec693ca5352c55c899e436c4389c2867ed9df373c4ae13356b9fbead30c621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061482, "uuid": "d4de704e-fd16-403a-85fc-8ec7d8f1a2c1", "value": "T120087C4263EA04C4F9F7DA759AE65617C673BC122F3095CF221C17291F736E08A76B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061482, "uuid": "776c6527-ff6e-4a8b-8481-06f586d90d09", "value": "56c2f8c966897cdb64954ebc4c75c126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061482, "uuid": "a4fefc4a-fd16-47ad-babd-bdd7e1a252e4", "value": "393216:Ltbu6uPZI7nqYAERCJbE81AKlkUiB0uu+sIyNOnS0B4AycWMCYDMbLbTOwEJ7eVL:LYNrgsJYUKY6Shrsxwbveu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061482, "uuid": "fa8148e4-5cd6-4958-944d-5ff4e26f4987", "value": 84247004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061482, "uuid": "b57bc2d2-c1b3-4e24-823c-dfc23e43c224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061482, "uuid": "c8fe1545-1308-4be0-acbf-1a29af114d9b", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1327a2-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038645, "uuid": "6ffc0171-d814-42f9-b247-6cb8cf1a0f1b", "comment": "Malware payload (Mirai)", "value": "54b655e77529e62b81c23f0ac9f5e99d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038645, "uuid": "bca29a3f-4444-4107-87de-df24c21d7447", "comment": "Malware payload (Mirai)", "value": "3cb6b3f148e62314a561404550a2dada50c8a308f10ba066ab6eafd97a8683d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038645, "uuid": "d642c38b-e6ec-46aa-8409-fc50a19737a7", "comment": "Malware payload (Mirai)", "value": "624a6f73cc18992ba3b6f2cc5c9c714938f2d9fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038645, "uuid": "ff639f41-00d8-49bb-8824-01cdb8762bf4", "comment": "Malware payload (Mirai)", "value": "0fe0a43a7c6fc7b3f8ad9fbcb495482564134f7eca8968a3b0824c086f9e82859f951e3d4035eae64b49264e9ddc3cda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038645, "uuid": "35ca5904-56ad-45ed-8bd4-7164d2847217", "value": "T1C0311FD5AAE05E6DD9D082BF8C4903587353DF4AA2D77613A20CA3689D1EA9CCD1B00B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038645, "uuid": "315f701b-815e-4ca4-a4f6-6f5bedc73d9a", "value": "48:7GJZo/6DIzagepFaFaX8S0OLBmtBageX:7Qo9KFaFWAOLEtBa1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038645, "uuid": "efd72621-ae92-4d6f-b88f-41176345175c", "value": 1776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038645, "uuid": "e399103c-255e-443a-88b9-8a0404ad4ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038645, "uuid": "e077996a-6169-434c-b318-bc7237278123", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ed1839-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038659, "uuid": "d3893676-a330-4f0a-93fb-6066a2476faf", "comment": "Malware payload (Mirai)", "value": "cdd96e9a6eb71ac0b27053574cb0983f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038659, "uuid": "e7d0aea4-ea88-41a0-a4ef-6bb3e3676166", "comment": "Malware payload (Mirai)", "value": "3ce8c211cd164cce2cb97766fcf8d1be924fb74787be367ae84e4d3b6b334cc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038659, "uuid": "7b53ba8c-b245-4212-87c7-1ace6e2e4a54", "comment": "Malware payload (Mirai)", "value": "5e405efda3ab44678e18567cb100f7b83f4343f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038659, "uuid": "34c8216f-e241-41a3-b9cd-99b9af2df790", "comment": "Malware payload (Mirai)", "value": "e83b06805b85a6d5d7a536516884b260d96a0c3575aaa72fd4930e9baf5cef2af79a6414148977452ae2f30c4951f244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038659, "uuid": "d8536916-5069-4909-8d10-bf2c9acf93bf", "value": "T1D8210DAABBD22D1ACDA4023BDD9F1764A322DF9890EDB503F34612010C2F3240F22289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038659, "uuid": "531d05b1-6f06-4f95-b277-4629b691740d", "value": "24:FyB0rDdja7jgE0Kh9t0Y466lFS64GvMHdH1JGafMsIaJXlxrNb4v0:FPrDI7iL+WFS64WQUsIaJXlxrNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038659, "uuid": "60032c88-cd01-4bd3-9b5c-083cb0193e10", "value": 1332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038659, "uuid": "10823074-9371-4efa-8f91-36743eaf42ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038659, "uuid": "83516daf-f780-4b1a-af58-e81b1471cf81", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00419fa-d2b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765034360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034360, "uuid": "f012e5ce-28d7-4067-93fb-7cf0c9d28c33", "comment": "Malware payload", "value": "ec6de61ddbbf868d0568aed95745af34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034360, "uuid": "d1881a02-e65b-4d8b-97ae-306f182f6076", "comment": "Malware payload", "value": "3d081729426b545424c40d36f39e7813c9bad5165ac8e6a1a8c93d0d1ae98bea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034360, "uuid": "ed77abbe-48c6-491f-8e3d-2bf09e0d7d21", "comment": "Malware payload", "value": "4693456a2705c8fc5321dca0236ae8d061183273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034360, "uuid": "4ba67c43-0c6d-4831-bf7e-6f4bdb1d1589", "comment": "Malware payload", "value": "e8d49359f2d8007cae8cbd6cbce9e9600f83320c90d23334ce762d386f844d4502575da5e24ca46de9288c02425f46b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034360, "uuid": "98bbfaed-8ec5-413f-9482-b88bb30bfe24", "value": "T13456AD05A3E501A4E437EA34CA668333DBB079965731C64F05A8E6562F73E608F7F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034360, "uuid": "4853c89d-b904-4e70-a82a-7b1fd8de577c", "value": "272f417b81cf4a85587ae98c74142aaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034360, "uuid": "62de06ea-39c4-4ad2-85f8-036df93f0d5b", "value": "49152:m+Qdpjz/21VfUGbfEjen7P+ANgqrrLjRisKUdYBb3P9shcKMimcgP1SGZGqt2Spd:EEEe+uYJ3lYNSS0/FGhyJYZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765034360, "uuid": "97ac7a71-0146-4ae2-a668-883fb0777658", "value": 6330368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765034360, "uuid": "8efa7b5d-f4b7-492e-a400-691067f69247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034360, "uuid": "d5d96a16-cc3a-49bd-b866-7629c39d38b5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2cc59c-d290-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765017948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017948, "uuid": "308ebd21-8210-4d11-aa23-34d53a410d8c", "comment": "Malware payload (AgentTesla)", "value": "3d00469611f9a1ffeaf8f192df89cef3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017948, "uuid": "6a40a235-aa5a-46a5-b6df-1b1735bec378", "comment": "Malware payload (AgentTesla)", "value": "3dc8c859eed9eddff08982b6c66790c7897589232dd0997ef97d4e094e600e40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017948, "uuid": "3716930d-6be6-4ce1-a747-30bb6e7e1697", "comment": "Malware payload (AgentTesla)", "value": "481fd9a371c3f9f252c410a3fa741ed11e85e5cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017948, "uuid": "6d47bc62-e85f-4f11-90e3-19f68d93087f", "comment": "Malware payload (AgentTesla)", "value": "a196b58b80e8917f11916516c86f89bfea0a88b04f064eec97bac0df18179910db93974d16e41f62564f272e4b4d2f8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017948, "uuid": "463443bc-2b52-411a-81e4-64c1e73b187d", "value": "T15DE423DB8CA07A673FD701F37406A8D86F35E13DC916064A0EA278DB5E354B8DB16189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017948, "uuid": "fdd07430-0b12-46cb-83cf-1b4be16daf0f", "value": "12288:gOwj69+zSAgn1ILl4e1UxlwkdnEAdcKyoXJCZHFOSDuM7ND:hwjHSw4e1UlP9JyMJQFxDz71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017948, "uuid": "793ba83a-a5ba-4162-aa35-81b234056690", "value": 678468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017948, "uuid": "d4eab024-c29a-4430-a6d9-dcb4d4a06460", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017948, "uuid": "f0b2b4ba-8930-48a5-82d1-feee221c36a5", "value": "PO.1174325.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703cd553-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765061204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061204, "uuid": "920b4d31-a365-472f-b1a8-fedfc9856a55", "comment": "Malware payload", "value": "bddb0ea998c9fd6227ae6e5352005e7c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061204, "uuid": "be777e58-3890-4ba0-b300-9c5e3c3ef182", "comment": "Malware payload", "value": "3f0c792386ee0dd77abde242365d89dfc7dd38ea396e4683518f84a4c6981ce4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061204, "uuid": "020dabf8-a833-4e11-9ed2-84ad72382697", "comment": "Malware payload", "value": "f1d2f35f2ef582dfce1e3efb73867a4da972b1e7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061204, "uuid": "c3b96e97-6294-48a1-bafa-1771422985ce", "comment": "Malware payload", "value": "a0f887c7ec22af036e65ca8994367eb56b1a02f72c616843ff7fbdbece9d3fac68d89c13ae54383651152954979ddfed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061204, "uuid": "ed3f345d-4f06-4115-8c54-892a5c56fb92", "value": "T17DF0A4EC0626596303548E85A521C08FE002F1C26B312F4DDE3AF1AD9CE929A3418F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061204, "uuid": "5e4401b2-c0f1-46de-81c5-56b1afb3b995", "value": "12:xnRx6Vnzo6nSNIjlT09nfiKl2YVn+6nS9ona0on4hmv:hRx61zhSNIpIKKljXSqs4wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061204, "uuid": "3592c024-ee2c-465e-af91-509e38816f64", "value": 577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061204, "uuid": "a676de94-da53-41ba-afef-dbe654a26e81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061204, "uuid": "a4952640-f95c-4d18-9727-e4187766a817", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a814e09e-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037675, "uuid": "999064fb-fa81-442c-b915-498248c03549", "comment": "Malware payload", "value": "7137f65f4a8978bba2485c60352feb86", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037675, "uuid": "f7f84d91-d356-462e-9f54-91cd99da4527", "comment": "Malware payload", "value": "3f1997850e090823c14c458596e416ef2cea3d4099d524a58e2c0e8b00ec5b26", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037675, "uuid": "72d22dce-e80b-43c6-b64c-22e3779ea746", "comment": "Malware payload", "value": "f5108e382f44cfa81a9c3afae27b543d4ef5d5c4", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037675, "uuid": "cb50b630-d9d3-4856-a88c-aec7d1d4983d", "comment": "Malware payload", "value": "05e613f3ec0fb7d10f2e038e3db94083173489131864500280d49adf4b994a3f4c592490f260bc78b8c53566a969d4e6", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037675, "uuid": "cda2c32e-762b-401a-9d14-32bcb24ba8ce", "value": "T1C4B733BF39670D88C9594E7081A24B70FEA1CEA7C35645F57B54FE5B03327AA8FA4042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037675, "uuid": "d5713512-9b8d-4295-8b60-2e30b57319cf", "value": "1572864:ALTKsBRDsWE6E6XxER6eniBaviiCeehORgSGN8sID2:AXHyWER66Ri+eQR/GN8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037675, "uuid": "63c01379-f8f6-4a91-85d7-420cf04f21c5", "value": 52174663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037675, "uuid": "508aa057-f226-4e24-bde1-c55c3836db27", "value": "application/x-bzip2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037675, "uuid": "308fe16f-ec52-4b4d-80df-5c9de386fc52", "value": "reiboot-mac_1082.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4b8c3e-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033840, "uuid": "51dd1b0c-506a-4dcf-91c2-39e8c80026a2", "comment": "Malware payload (Mirai)", "value": "37ef1eff8974f7c281cc02b696ebb103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033840, "uuid": "528a088e-a4b0-49a7-896e-e75972c55821", "comment": "Malware payload (Mirai)", "value": "3f5f53d1a70f13a67c05b1524ed0d242236da879132f9204419a9633e96f3a05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033840, "uuid": "834e5021-c074-4649-8ffd-4aa6b16707b0", "comment": "Malware payload (Mirai)", "value": "ee4661739f3bdea5965a45dfcee4adfa1933d99d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033840, "uuid": "4a466d8d-01ca-40a2-b74c-cd41ebae94d4", "comment": "Malware payload (Mirai)", "value": "a40114eab02f04780cd70025a7b45737cbecf7560dfbd7d2902b25a7d34f257007db9b5ee434bffd82f37c719fb7f44c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033840, "uuid": "614aa9cf-640d-4929-908b-5140d9557cc8", "value": "T12EA2E1666C2B0FB7DA9C73717482671AD6D13861C36D031786F8675F2ABF025B8630C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033840, "uuid": "e07a59ce-ebe8-473e-885a-001f82af4f11", "value": "384:MAKn2cNV2Jq5AeALov9O/ogWlU+pE/lnb8csNQBKxxp4bvo0Ny9:AfVB+eALovIoix9nYPxyA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033840, "uuid": "5d4dba7c-7c07-4e44-af6f-e18b14fcf912", "value": 21908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033840, "uuid": "c9a640c4-341f-4120-b9a4-a4efbf343679", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033840, "uuid": "5dbdfb23-8b00-4cdf-bb6b-f8a3e688452f", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b460ead9-d2b9-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765035548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035548, "uuid": "6c087acb-27fa-4441-afb2-5418970d4fe7", "comment": "Malware payload (RemcosRAT)", "value": "12b17193c3570825b06d67ff2c8477e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035548, "uuid": "1b177be3-7e09-4d91-9e61-519d11945f71", "comment": "Malware payload (RemcosRAT)", "value": "3fd5ff4ba1ec4335638de095dc76b0196ca00a4a95295614cae2ac83c4a087a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035548, "uuid": "8f6ef856-e2c3-4878-b821-75e370512451", "comment": "Malware payload (RemcosRAT)", "value": "8fb644f7448a793d56a136dac59687f34e4adbb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035548, "uuid": "0f512029-f805-498b-84aa-36a338af7e50", "comment": "Malware payload (RemcosRAT)", "value": "f7dd7a1341d6d6fdee88024bdd3a656426f796ef24c16bcd0d4444787c47f2229fbd3df28d9e53ac599a658a6ed067f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035548, "uuid": "12be860a-b99b-4b22-a762-22c869008b30", "value": "T161649E46ABF0DA59ED75CE344C65E92F0A5DB81936718EBB30CA0C13EC9B9204F66D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035548, "uuid": "034ceada-f199-4793-9322-d8d3d53d3d65", "value": "6144:BkaQf2OcIBMNpGWmloMnYA1oQoIMjJuZWrpaycIb:KsP1mKMY4oNItZv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765035548, "uuid": "4513813a-99df-4b3e-890e-542f505563d2", "value": 318469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765035548, "uuid": "2a995a6c-7615-4912-8ec4-eba777f5aff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035548, "uuid": "0ec142fc-6692-4a8d-85e7-18a5dd9bc176", "value": "final-payload.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a36e23-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006126, "uuid": "b2f82679-5a9b-485b-84ad-34a9174118c8", "comment": "Malware payload (Mirai)", "value": "620aab72ff4be70b10b236e1c169e78a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006126, "uuid": "5abc1595-5888-416b-9393-7b65c5edf11c", "comment": "Malware payload (Mirai)", "value": "3fe8f73a5c69e473d17af7d34c2c2653ebf78411fdd88efe5752d39464881fb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006126, "uuid": "6f1a6b59-8f4f-4748-afdc-f8101e2143b6", "comment": "Malware payload (Mirai)", "value": "c8e26e006efda7546c94dfdda62a4911289b6087", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006126, "uuid": "0ce98908-ad0f-4da1-a6d7-6b4abafcb65b", "comment": "Malware payload (Mirai)", "value": "253fd9335cdc7441877b243d2d7c3e75a7bab8cae661f725d69d3a8fff586cbb26530fb4b51bb9b7aeb27b07e1aebbe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006126, "uuid": "4806135a-e610-4d1b-a1d2-013db2fea58e", "value": "T14531F105F2280817D8E17E746B7B1B879B3B4E130634560469CB9796E5748740D8E49C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006126, "uuid": "80a7f3c1-eac5-4f26-be1f-d52b806f6025", "value": "24:3ori5nSWSxnSWW6S7IOSA6SBARKPfZXei1lyeR7hrVtffnOA23vt6f+jOxHvdzcM:ycc2N7ZXdKeR7hxtffo3vlSH1zcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006126, "uuid": "b3c49017-6329-4716-bfdd-e54824403371", "value": 1736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006126, "uuid": "71b18c37-1452-4a8e-91e7-61677b17ea34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006126, "uuid": "0ec2e502-0a6d-455e-9075-4d9b906398da", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1915c50-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006364, "uuid": "c0d1583d-ada6-4051-a2f2-d5f4b9ef45c3", "comment": "Malware payload (Mirai)", "value": "fd36d00022c446612b0bb82273537826", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006364, "uuid": "506c8ca7-b143-43d2-a614-0b7ec3b140cb", "comment": "Malware payload (Mirai)", "value": "3fe97efc5006610f2c4df9ca616e7607520c005b95c9fe324f2e64d4624dadff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006364, "uuid": "dbfb7574-cd20-4d64-a967-b4bdd318c8c7", "comment": "Malware payload (Mirai)", "value": "fe0dc7bfc2652152e90b86f269b4dab2f4e57b18", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006364, "uuid": "86de83f0-a049-4695-bbf8-e44855357f9f", "comment": "Malware payload (Mirai)", "value": "d1fc55428b55fa14953ed0b6e6eb31d749121346d3f7600ce813a10f81e4cfce355e26bf7aaa1289bacfbd0a12937f23", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006364, "uuid": "5e66b248-8e9f-41bd-a4a3-93263b94a9f4", "value": "T124F0A2DDA0730073A84DAF0BE174874DE111FA94AAD42E6488EBAC19783DC2270D2A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006364, "uuid": "c4bc5865-a07c-443e-99ce-51a09eee4554", "value": "12:d0FJJydAjJdyzmdyzNdyuGjJ873JkDhZMuvs:2hj/HqOGwlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006364, "uuid": "eec9923c-283c-49a3-ad39-f62bcb727c0f", "value": 653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006364, "uuid": "ee88df83-93c9-4439-9db6-a06a3ea79ee8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006364, "uuid": "bd22e676-560d-4464-9b31-eaeec40babbc", "value": "fttt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8eea040-d28f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765017544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017544, "uuid": "1368513f-b81b-480d-85e2-a30953deb0ea", "comment": "Malware payload (Mirai)", "value": "99b428e894be0a569bdad471077bed6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017544, "uuid": "49387397-3374-4eff-b284-f0902a774a50", "comment": "Malware payload (Mirai)", "value": "412dcec02119e2c26865b969786717379024e2d98c1ab261949b85c55a365eda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017544, "uuid": "25322d20-8256-4427-a111-86e3dd2ae70d", "comment": "Malware payload (Mirai)", "value": "e234d1b386e6dbbf0befbce8a6298b7166d3928d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017544, "uuid": "d93e91e2-1fa4-4a02-bb93-ce5c72c8612d", "comment": "Malware payload (Mirai)", "value": "a9716135c1b83ca8bd8d0d048c47ff43ea7ec59287850302db21e9bbbff11dc444417723d2b495a837e4b045850d3ef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017544, "uuid": "ca8fa9f1-73fb-4f30-b0e6-2782c05ae3f8", "value": "T15923F1BC8A1140CFE954EBB32FECAF650E140BD365CAAC642345B7958E5243DB4DB784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017544, "uuid": "150f1c50-235c-4e78-961b-564e0b8a62ca", "value": "768:nNe8H48HAEEokYjo0lRlPsl8nfwHg3rpfGNT8pvSCwtGv5LVwuKMrXox/EAcOhvX:Ne8H4loHvlbs8nfwKrpuNTkSfGvxQQoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017544, "uuid": "6cb016f6-5c98-484b-8f17-9726636eb332", "value": 48120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017544, "uuid": "e9b76419-2070-436a-9be7-164e11d1aab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017544, "uuid": "968d6014-28ea-4d10-9649-5d855d67bf4d", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f245d74c-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038658, "uuid": "bceee121-d34f-487c-aa87-5e7d783b880d", "comment": "Malware payload (Mirai)", "value": "4522c3713e2518b856eae0f02daf79a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038658, "uuid": "bf0ad88c-d7d5-449b-a892-dcfa70aaf791", "comment": "Malware payload (Mirai)", "value": "4142db3625962151bc901fa1945c01dce5b24fc3f712e6c55c13e799d8505694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038658, "uuid": "70ac558c-84b5-4963-bdff-021d303e5e50", "comment": "Malware payload (Mirai)", "value": "6003c39a9575f4c013c24d480ecf61e913c53bf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038658, "uuid": "6139aaba-8a69-41db-a449-b9206d18e542", "comment": "Malware payload (Mirai)", "value": "235fcc0bf78b9b46c212d9f270995822aa7730f7db98076ee8852716bb2056fb5befe1eefdb310ff6c2a176efb923fb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038658, "uuid": "6c1d5341-2124-455e-8f62-d57ad2b5a915", "value": "T1363131D5A3E15D6CD4E051BE8C4B0F28F3369F80D2E37123920C33289D29E785E2A465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038658, "uuid": "d54bc8f0-a3b4-4400-80e1-310589843051", "value": "48:mcJKGJZ2oNi/YqepFaFaX8o3ABubLAS4:mcJKQ2GFaFWfAlS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038658, "uuid": "948405eb-98f1-45af-84ee-89ddd78bd4f0", "value": 1624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038658, "uuid": "e9d6e46c-cb5d-445e-af13-62dd484e82fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038658, "uuid": "09a42510-1b65-4546-a423-74338c5f303b", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da78bc53-d266-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764999964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764999964, "uuid": "2ec1acae-1cae-4b17-86f4-22b644c9f084", "comment": "Malware payload (AsyncRAT)", "value": "19196b0b0c8bf5a8a40e18a4dd00785f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764999964, "uuid": "94461d9f-2567-4a13-9102-f416ef45bf3b", "comment": "Malware payload (AsyncRAT)", "value": "41b1cb94226d1c5d046f50258593ef8db49d883178b64ad77cdfd1b0e9990b0b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764999964, "uuid": "2233b7c2-f29d-4165-b946-a3566dca5766", "comment": "Malware payload (AsyncRAT)", "value": "98354319f5c14d93f61791d393876a005e2e68b8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764999964, "uuid": "5d55a61b-ae61-4650-8c03-6fa7a3cf2d72", "comment": "Malware payload (AsyncRAT)", "value": "915e7dd0fa1435ec8c609bec7864f87a4f563b1ef4b83e72cb6736b5c4abc4675384746b94aeee5d2583669bac0819da", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764999964, "uuid": "3e5a1152-d4ac-48e3-8abc-a7e388c7e6b5", "value": "T12D234B087BD08621E6FEABB51D72B6060671E6078D13E75E08E483DF1F27681CE917A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764999964, "uuid": "7ebb6c81-1c88-444a-999a-cdb28ff3bf8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764999964, "uuid": "a3838155-bfb7-4ad3-ac3f-1c7930fbd7a0", "value": "768:d/rxgvGl29Jv5JiTGGo1TcMc1ElYztQiVZl9wbFEPr9pKV6iOChTzjug8:dziC2OqIpalYzFtGFM9oV6iOCdf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764999964, "uuid": "612be28b-a747-4a12-9ba1-8e09eacbb096", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764999964, "uuid": "e13c67ca-d8da-4427-b563-fa99f4a884b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764999964, "uuid": "697d0aac-d2f4-4f8a-8e4a-6df706cc109d", "value": "System32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af55a7a8-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011917, "uuid": "2ab7b0ce-ca7c-48b7-882f-044ecacbe784", "comment": "Malware payload (Mirai)", "value": "13261b8a3f6d127eeeb07dcbf2e2a290", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011917, "uuid": "28931341-77ee-4d65-aa60-839338bb9c57", "comment": "Malware payload (Mirai)", "value": "4220c796e00695fcb78e8f135948cd356855ab8dbd48e7691ac7dc2cac0d0ef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011917, "uuid": "f7178987-96f0-4446-8123-4c5ba676656b", "comment": "Malware payload (Mirai)", "value": "837c0f778aeb20be10a689ac452016b9faab0bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011917, "uuid": "d7e73bbb-c316-4352-adb9-5d6d440a9f46", "comment": "Malware payload (Mirai)", "value": "9f1d01f02c18958b17adeab2fc6b66b36275c457c895557f0d892607214eb2150eb36fc637b53f7519814d280df348b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011917, "uuid": "400559b0-6357-48cb-9e77-09ad6587dcae", "value": "T13A330A96B8818A12C5D403BAFE2E118D3313676CE3DFB3129D106F1467CA96F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011917, "uuid": "737acdbf-5f4c-44ca-a1f3-a924c1798f72", "value": "1536:cZn44OGOwdqnQgo337iVYXN5LoITiULp53WO1:7hw4Qga7iELp53WO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011917, "uuid": "3420e518-f047-4312-9193-d43b2dbb02c9", "value": 54404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011917, "uuid": "1955d8f5-3c3d-4370-8491-b7ddca777b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011917, "uuid": "b1283870-8431-445c-be09-a336d7f5cb16", "value": "hoho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83e95ed-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038668, "uuid": "50decadf-6fb7-4662-9cde-f02b5c66416e", "comment": "Malware payload (Mirai)", "value": "66cce059e5c128af90198bf25be6205e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038668, "uuid": "d24e831f-7ec0-4025-b939-41f89d931d1c", "comment": "Malware payload (Mirai)", "value": "4246744e084ae75caa5ccd573cd9fffbd7928f57269ce913685d6a123998e589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038668, "uuid": "cc57e8f4-d6d5-4633-89ca-54f612cf86bc", "comment": "Malware payload (Mirai)", "value": "bef2a4934d40e1bbef5bd856ed2d6e639163d2ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038668, "uuid": "0c933fca-3c74-4fdd-9e31-9a9cb6c0d67b", "comment": "Malware payload (Mirai)", "value": "361eaaae984ba628686e04c090475ab8c4ea6c6897da82dcb97d48d8ae0ea507265f0d66b8c5406c68efcdb0cc823b9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038668, "uuid": "b32d69ed-59b7-46b8-adb1-81770a245892", "value": "T121E33B46FA414A13C4D517B9BAAF42893333A754A3DF330689285FB43F86B9F4E63542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038668, "uuid": "05e3f8f9-52d9-40b6-9985-998e581b959d", "value": "3072:unjzSePciCUOwJli7cgdzn6P4mxLbQlB0vEefnsM/9CT9:mj/PMSi7rdzn6P4iLbEoEefsM/9u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038668, "uuid": "4c367a91-85be-40b8-9a29-ac6ceab369e4", "value": 147630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038668, "uuid": "e7eeddf6-2dd6-44b3-9e99-a6bb09b9304c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038668, "uuid": "633cea52-c134-4d4b-91b1-f968cd09fc49", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4070e802-d2e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765055110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055110, "uuid": "3c9d4d2e-69c5-4fbc-9eab-c9dd254e435a", "comment": "Malware payload", "value": "f0f5bda28178314b3d87a2c37ab003ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055110, "uuid": "91164069-e903-4c15-9094-8d4cb1c9da95", "comment": "Malware payload", "value": "42a822998ce7c2be43e58dad17d1fcd1675b54f4bb79bbb93522d2442cad80c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055110, "uuid": "8d2c8b16-f39c-47cc-b15b-27ee56bf0c1c", "comment": "Malware payload", "value": "43f6b89deb1ac2493282e70d492b0cf618861355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055110, "uuid": "50d75963-2605-4d94-bf3c-46a714c726be", "comment": "Malware payload", "value": "73f625cd30a55e59e6163be797e1bd41a439e4718c2fbdb5561568a645eacd505383147092f12c31931c95a04ecf0e0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055110, "uuid": "9c3247d4-e5ca-4d60-bde1-81aa434398e5", "value": "T149E629361BA9296AC3D78136F078A894273227F1354E79BBC099D7E70CFA253971DC24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055110, "uuid": "f44a088f-19a6-4b08-b7ca-1b297d26bde0", "value": "36c2743ce7cec0e8ce00073cb13f9b47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055110, "uuid": "418f0ce7-dce6-4e54-8607-aa228730eda4", "value": "24576:liU3t4XZhU9/9mf5WOYd1XDenpNgsZSKB/LlUsB+TgQjb4xXLLX3gVkytoJ3aQqm:liU94XZ1ATmRtssS9KLD+ni6xMpXLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765055110, "uuid": "9c5f6c75-4d7b-4696-9cf0-76fc5dd33fec", "value": 15023616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765055110, "uuid": "27f3bc6e-003f-4e80-b657-9074bc5d2cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055110, "uuid": "7c5625c2-38af-4a6d-9b95-10adc7a40889", "value": "libvlc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2a7224-d2f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1765061737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061737, "uuid": "c464e056-bbae-4200-afdb-8084922b531b", "comment": "Malware payload (Socks5Systemz)", "value": "fa846f770b47fea275535688846a6da5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061737, "uuid": "f57cbe11-5746-4bb0-906b-a18e0a69316b", "comment": "Malware payload (Socks5Systemz)", "value": "43ee090cccb6bbb213e340d5fdca1d205b69db6ffe9b5c7b87fcf65a7690ebcf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061737, "uuid": "33a42b77-a144-4c0b-b1f3-b7acd2f94c64", "comment": "Malware payload (Socks5Systemz)", "value": "740d5000f22dbbb1dbc1837bf145c1e86fd933ad", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061737, "uuid": "e2127e8c-5c90-4782-94e9-bfd8f1dda630", "comment": "Malware payload (Socks5Systemz)", "value": "79e7162f0eaf3dd923152a203f7642fac482b822f7f97cfee4d8bf34cd5e089ca272b631c6b700de8071a604b25aa8b5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061737, "uuid": "49eb9716-975e-405c-b74f-2694ca920078", "value": "T19B0633EF73629174E18026B454345DE513EBFA1CCDA6F25AB54F11C8D3BBA40EE2072A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061737, "uuid": "d6539fdf-8d6b-485f-9129-3170d2c4b810", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061737, "uuid": "f17ab255-5fa1-4608-be3f-664361e664a4", "value": "49152:C9BQdma4+lJtysN1RwyksFIgY83VY+7r6QB/G2Ujrl3hUdxn9rnLgEaHKBZ4igcO:MqsvUbNTkspx+jQNgorZaqBZ4iqj9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061737, "uuid": "5b5d7599-1ee2-4503-993f-9923ef8bbb2d", "value": 3979001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061737, "uuid": "f527b5f1-d8ad-4bb6-a870-a75070155425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061737, "uuid": "4e452655-65d4-42e6-9241-3c8d783ac2da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4ca316-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038677, "uuid": "e72d9858-fb48-4af8-bacf-6e890e7a8f41", "comment": "Malware payload (Mirai)", "value": "3bee9dc3ee116f8c13add500368964ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038677, "uuid": "4f7c9d53-ff96-4b10-8d33-ea08a53992be", "comment": "Malware payload (Mirai)", "value": "43f09aedbee5a7985ee7651d47257e8ac429890e36b9fecd87cf3e0c22625786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038677, "uuid": "0e056117-63dd-4d38-92fb-42c6a1674f6c", "comment": "Malware payload (Mirai)", "value": "3c8095da3f9c33d8198a3079d28cf94667e1df7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038677, "uuid": "fe6f91f7-3b03-4858-87a5-e1896f90d08c", "comment": "Malware payload (Mirai)", "value": "cc149626ba564638b4cc886d9f67eec7779a77d08d6fe626273bc65bd49c04109aa5927716b878cc457a64a252a779be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038677, "uuid": "e7c5e6e0-15b8-4045-ba97-bd3ccff51dd3", "value": "T180311FD5AAE05E6DD9D082BF8C4903587353DF4AA2D77613A20CA3689D1EA9CCD1B00B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038677, "uuid": "c2a7b435-1ed9-4671-b432-bf6f4cdbfb54", "value": "48:7GJZo/6DIzagepFaFaX8S0OLBmtBa4eX:7Qo9KFaFWAOLEtBatX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038677, "uuid": "2922bd8c-84bd-4eae-bd86-2cb3b3482a93", "value": 1776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038677, "uuid": "1cf9711e-c554-47a4-9aa9-8d8741e77c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038677, "uuid": "a1f39fd6-4b68-4422-a61f-bed2e296c0ce", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f981b88-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765061202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061202, "uuid": "f1c7e1fe-8e9f-47d1-b64f-886fbe931f56", "comment": "Malware payload", "value": "b2423a28aca32b1ca0f18f0264b9c811", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061202, "uuid": "58ea6c15-e68d-4b4a-8834-e978aa2a84ef", "comment": "Malware payload", "value": "451614703b3735db5be4130dda7fd9d952ca82ebae73733a6ddb72e4c8c708a5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061202, "uuid": "8584a038-5399-4ae5-bb99-9efe2828e1a0", "comment": "Malware payload", "value": "247d8e6ba8e1724757ee6992645197af0e15da0f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061202, "uuid": "74d5bdee-812a-459a-a54d-76936c453a2d", "comment": "Malware payload", "value": "201b9aad2ea0e3b4436f3c65ad6535b7a09c158d40dc8519f90641de61ebeedb2e9cbb83ed41d6ab26dda4d3d1dbe99c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061202, "uuid": "af7df675-79d6-4b42-b4b1-b1eea4b33994", "value": "T1A7F044EE0622593103548E8625618483E00AF2D16B712F0DDE7AF5EE9CD969A3018FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061202, "uuid": "d8060551-3393-4ff9-a065-5d65df800bdf", "value": "12:6Rx6GzoBSNIjlT0OfiKl2YG+BS9Xa0X4hmv:6Rx6GziSNIpTKKlMASV34wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061202, "uuid": "fddd937d-07fd-488d-81b8-5231111cfd6c", "value": 576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061202, "uuid": "4a9d9086-38f5-4a14-b6bc-33c475f55c5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061202, "uuid": "9e4193a4-4ee4-4cec-addb-accf37095da2", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00850b8-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011918, "uuid": "045834b9-b86d-4684-b570-afe27b2e6f83", "comment": "Malware payload (Mirai)", "value": "7a5855b5ff8679cdd376e033c474b587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011918, "uuid": "f9131970-be38-4d9f-9a9e-965bc66a6c1a", "comment": "Malware payload (Mirai)", "value": "46847fed996c2db1ebde124d32a0a9d79aec28f1d5976a96a17b2d21e3b6719d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011918, "uuid": "2e6d4ed4-6505-424f-a9c1-e1807ae83270", "comment": "Malware payload (Mirai)", "value": "79b3e8d8cd8ecabbe7de467d682d06be6f45c45d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011918, "uuid": "ddc5932e-cf54-4014-bffb-6c620488f7bc", "comment": "Malware payload (Mirai)", "value": "6eff0bee8fdf4107dff0f54d0767085e9e9ecf385f1f946bae5ff7fe6e406fe01ddf12ceb1acb8f014ddaf55da7c0cfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011918, "uuid": "2ae62af8-8a21-4eaa-86b8-5497e3a9a098", "value": "T1921329D6F805AD7CF81FEBBE84134908F671274551930B3667ABFDA3AC321948D62D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011918, "uuid": "b13c28a9-3c68-4731-8cfc-5050de5c36f8", "value": "768:5ZeGt+aGKkeyIgkXvAZ7uzYZnpyUFN61J9hiG8AQB:vN+9KkmhvAZi8nyU/6P9hx8AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011918, "uuid": "de9dddb1-7593-46c5-bca6-8cf80882c15f", "value": 43412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011918, "uuid": "a4f174a5-2ae3-41c5-8733-0d8a114e8581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011918, "uuid": "261aa4e7-27c8-4ea3-b6c0-b7b2a6d0b94b", "value": "hoho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ab6b57-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042122, "uuid": "b9bb7bf6-906e-4984-b791-7cef91c8bb0d", "comment": "Malware payload", "value": "ced47b89212f3260ebeb41682a4b95ec", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042122, "uuid": "b157549d-a6cb-4301-b194-7bcaa9a23897", "comment": "Malware payload", "value": "47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042122, "uuid": "39e8b791-49d2-4713-be4f-db372ff31389", "comment": "Malware payload", "value": "148c0cde4f2ef807aea77d7368f00f4c519f47ef", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042122, "uuid": "5f73ec54-7a68-4200-bfc5-c1b8d833afe4", "comment": "Malware payload", "value": "8a4646ff1171d53373024b7eae79d07300ebf94766523fc34e1ab9a008544d31c07acbbdec8a60017071548065b77dec", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042122, "uuid": "94945671-0cec-44cd-be61-c24d722c8376", "value": "T171B3D598D3315286D85B8272C9526791BF70F3707361E39F829251BE1D47FEB1EBA208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042122, "uuid": "e9d5b19e-9854-42fe-8cc2-e8329055ac55", "value": "1b38467bccadb1f8182353cca9fee8ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042122, "uuid": "1a634f9c-dc3d-4bfc-998b-221cf56c3d84", "value": "768:0MdM/AcPDiFhlPqbgKq0qC9bheG8FHrtjBUQEEt11l11e6O6yKo/Jqq0nGxobqkD:0LShhKYSdgpjNEEaB0BEj+9QvUb4obB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042122, "uuid": "a98f8609-b558-4bb4-ae64-a10c1c6deb43", "value": 116800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042122, "uuid": "06b90c0e-67e8-45c2-a3ce-8a90fa3eedd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042122, "uuid": "a1a845eb-ec59-4b0e-8f4e-9f1443c1c540", "value": "BdApiUtil64.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50ba8d0-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048917, "uuid": "46877dd7-df3d-42e8-b975-0a6fd022995f", "comment": "Malware payload (Mirai)", "value": "0b8f0e26dc0705ae0b6be9407b072395", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048917, "uuid": "362c44d8-e113-4799-bf91-50eff4d37014", "comment": "Malware payload (Mirai)", "value": "48060aff3519f9452bc463de59a2ca64e9db5a78c962142c36990e77e5ba6e4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048917, "uuid": "394dbe61-6211-4480-bc6d-4c8060fa9838", "comment": "Malware payload (Mirai)", "value": "36c6a4f0d8d31a2160fac7fb5a7eb8d1e5a92c4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048917, "uuid": "47a54d83-159d-4a26-9886-f9695ffa1ddd", "comment": "Malware payload (Mirai)", "value": "e7fcc8b65e41423e49aceb220ab9985a407c23dccbab06e1cc5f58d50316a9f0934331c11c2ed907e4a8e6086c61cfcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048917, "uuid": "a24552b9-c57a-4eae-a90f-049aa89ecf7d", "value": "T13C8308B51946F26CEAF65078F80330E62141070C37DDF2D3A183557AFEB5688766AE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048917, "uuid": "dec3c273-b4ed-441a-8305-6e20c35904df", "value": "1536:REvBjSJcAdOHCHUM/q5h5w7zKXW9jEnj5XRmM:REpzAdOHC0f5azqkjEj/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048917, "uuid": "17e195bd-8880-48cc-a92d-80673b492a1a", "value": 84972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048917, "uuid": "4b4fd793-7968-484d-9d66-4bdeed9db0a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048917, "uuid": "fd634ecc-edcc-465d-873d-e21d17654778", "value": "jnaudsbsgdibfhfhdhdhfhf.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba4ee8b-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038647, "uuid": "ef76f7f7-1a4c-434c-9bce-4223f2e9628a", "comment": "Malware payload (Mirai)", "value": "ad1d122e44a30ebe0962e519ffa9667e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038647, "uuid": "145475b4-5f4a-4a0d-bbcb-84a400864244", "comment": "Malware payload (Mirai)", "value": "4812e217f4ff45508ea28cafa918964c49e24795b8b5052aa55bf64644e828c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038647, "uuid": "dab765d3-f675-47aa-83e0-152d35093b97", "comment": "Malware payload (Mirai)", "value": "eaa7aebc694c028eeca7b68f48b5bf67d0e161ad", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038647, "uuid": "b33a4e93-096f-4b3d-a988-75e05550689a", "comment": "Malware payload (Mirai)", "value": "3c58fe6caa21397e7bae168e609c7812b6a4a0773d1e505cb4e9482b9cf45edbbb724af5622313dc11d7939eb085774a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038647, "uuid": "a95114d4-bd9b-4904-9d51-81aedf2fbd9a", "value": "T145E086D9A4720071B84CBE2AA56D47586051F795A9C4272444DBBD91D81CD453446A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038647, "uuid": "30128b34-7949-4af1-b1ac-6d8ea694504c", "value": "6:h9OnFflE0FJ60hMwXJfLFNfZ5B6Ea5XKbF8dvwtMs:d0FJ73JDhy7COs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038647, "uuid": "b871a2cd-a946-4440-ada6-a0b2b51c2cd8", "value": 311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038647, "uuid": "4796838b-5bc3-43b7-8ed7-9f9469248020", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038647, "uuid": "c7616e22-6058-472e-9773-d330c924fcb5", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86aab65e-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050074, "uuid": "af741a1f-f99d-42e1-a603-cd59adba4f0e", "comment": "Malware payload (Mirai)", "value": "4b02646168374562ff7ee12771c46243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050074, "uuid": "9a592ad5-26e6-4092-b80e-be78647d0226", "comment": "Malware payload (Mirai)", "value": "49706f08e21ef6e66d89bcf96ee360a0aee4722f4c4a132500fbce8a34f02cbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050074, "uuid": "d7c7f4db-110a-41d1-8c2a-03cb6b1d0042", "comment": "Malware payload (Mirai)", "value": "3cc7c04667b54fdcb074f51c104789563cc46845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050074, "uuid": "ed98a7d5-82d3-436a-89a2-8d7ac02f2518", "comment": "Malware payload (Mirai)", "value": "180d8ee3f0a65451e21a1fcc9ef2fdb8633758361ca7dcd2682f24fdee702c99066202e57d08fb96d04eda1ab67899e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050074, "uuid": "0ba7dbf1-a09b-4d39-b8e7-b95eb5e55914", "value": "T188C39E87B78B10A0C4624AF017C71B9D6F53B211CE5FE8E3AC1D663F5A7A4DB1916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050074, "uuid": "88c13cb2-b5d1-4949-865b-0a240dfd5f05", "value": "1536:U68QyAmkjsXzSi5Ln6iCGrf52T+biLdT6XqlI/uCAYUxP/QgEvEn/LW8:/YA7jozSE6iCGL5c4WR6Xq9CAYVgfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050074, "uuid": "1ecf43bb-39b8-4945-a5f4-a8adf5d52d4a", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050074, "uuid": "539ee937-9f6b-4270-8f16-f30210f01eef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050074, "uuid": "48d5d2d8-b57b-47b3-a986-0dffe5b1dcc5", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493def07-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765049112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049112, "uuid": "8bf0dd25-d520-412d-ba5c-e0ee738eefa9", "comment": "Malware payload (XWorm)", "value": "18273e141045d945efc64e323e7ca8ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049112, "uuid": "1fd2c3eb-33f4-47f4-85ca-11bbc96fb22e", "comment": "Malware payload (XWorm)", "value": "498b5f53a6ed0ddbdb57410944503f6e65f832abc6eddc29fa2f902e2878fdbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049112, "uuid": "cef125b4-ef0d-4ab6-8143-3f79c923b413", "comment": "Malware payload (XWorm)", "value": "551c0ddaf5655d3b5afe524e728192fe1a8df8dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049112, "uuid": "78c132f9-d411-489e-8979-8ca20433092b", "comment": "Malware payload (XWorm)", "value": "2e3a81edd54b99bd2690b3a2cd9830692cb03377a388ccd1a90dc381f83ffd3a971ace8e92550e6e79e1479ad0c9f20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049112, "uuid": "a100b373-7ab6-4e5f-b808-5c4fa5e54f01", "value": "T12EE24B487BA88327D6FE1FF219B3910112749513E913EF9F0CD595EB6B6BAC046013EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049112, "uuid": "998e56d6-eba0-4642-a410-9ae278d8b3d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049112, "uuid": "239335dc-00cb-4d14-8fd7-2cafa6a0cb89", "value": "384:I2458Ytf+1mOEUehuzD2LZX01uYTEyPjImRuptFlBLTIOZw/W2Zvn9Ikn1XxOqh9:0+1mOE1yG6u4F8m0FG9LPOqh6bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049112, "uuid": "1a4e1b33-bdc5-465b-b3b2-8e4149011d8f", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049112, "uuid": "83f7cfb3-ccec-4c1f-956d-3a728fa27394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049112, "uuid": "4ada2d17-c498-42e8-beac-6e319bbcaa83", "value": "18273e141045d945efc64e323e7ca8ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce0af69-d28f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765017309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017309, "uuid": "00553852-cf98-4a5d-8602-77a2bc6f3e85", "comment": "Malware payload (Mirai)", "value": "cb3ad6a5f7a723a9d4a7ea1a9b23e0dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017309, "uuid": "f328f36b-45a9-461e-beb4-9f90fe54b282", "comment": "Malware payload (Mirai)", "value": "49cc2f75c5b42d600d0e6ee0199b02ef0e1853cc3c2fadcaef9ec4e0ba89d1ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017309, "uuid": "81c30935-8740-4a89-919e-8c6da035433a", "comment": "Malware payload (Mirai)", "value": "958bb3a625c35d25fc7dfc855eb4d765d1edde77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017309, "uuid": "064d3346-3a8f-45cb-ab89-1b17cb149101", "comment": "Malware payload (Mirai)", "value": "156a3a2529aec7363e11a8d617800db2367ab216b4b4579897201f52982532b54b66b6616b01c4254d9e11a8c2f6dcfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017309, "uuid": "65662d8f-c7cb-47e1-bfff-ba47af289187", "value": "T1E6B34BDAB401DD3CF86FDABA44270D0BB930936156835F2667ABFD93AD331A47812D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017309, "uuid": "d1724397-49c9-48ab-84ea-91ff273f85fe", "value": "3072:2TCA4uocD/sKYIER/cCvqvHzcNv2vIIXZTz:ZA4uoa/sUKeHQNZkZTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017309, "uuid": "95d62b37-1115-4691-bd91-2bddaacc9952", "value": 117488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017309, "uuid": "4416cbf3-3fc4-4d38-abcf-7c8de0c6d87b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017309, "uuid": "aa4d1c9f-19a9-47e7-b5e0-0986b2835bda", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e2815f-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050148, "uuid": "a9b089bd-fce2-4f7d-8f03-78333326cf0e", "comment": "Malware payload (Mirai)", "value": "bfa8b1bdaed3a06fe7bbb9ab2d3e7626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050148, "uuid": "72ff26dc-1dd3-482e-b4b2-34d07191f7d0", "comment": "Malware payload (Mirai)", "value": "4a3eb597358d6660f285fe7c8edddc2002b3c90db234ed6c80b8ea2b0b23801a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050148, "uuid": "1878bf7a-2f42-492b-9e6a-8d7f33e8e434", "comment": "Malware payload (Mirai)", "value": "26ab4f0f04dc603602ecb38b411ed56a75c30158", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050148, "uuid": "b3027c55-966b-4b18-95aa-9cefae38ae99", "comment": "Malware payload (Mirai)", "value": "bbc05371a80b1593b515b083db1ccf19c729728c39005f3f3daddfcb787af74813a62bb8d6b3de0a9ff30838902ca09e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050148, "uuid": "445339d0-41a7-497b-ad0c-86a80b0cd4b1", "value": "T17A834A0375C0C0FDC899C17557AFB636C863B07E1239B15A27D8EE26BD8DE502E6A9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050148, "uuid": "46598ab9-4917-4a84-8f71-925dc30c744d", "value": "1536:QsbaijvT9kcRTPr0MSg8/Y91GS32SgVN6kgYEzYzXNO:ldjvTZRTPrqxc1GS32tN6kgtoXNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050148, "uuid": "a4c81d33-b895-44f9-8711-683c02703eff", "value": 85792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050148, "uuid": "e102be94-5a2c-4e9d-a1f8-099a6205e68b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050148, "uuid": "c195b18d-19dd-4db9-ac21-3477f072e4f6", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b847079-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042271, "uuid": "7f56c9bc-4abc-4309-97e8-7d34994fd141", "comment": "Malware payload (RustyStealer)", "value": "3b53bd591f29e0a2cc3d500db4c4cf8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042271, "uuid": "a05c4243-31a1-47a1-92e5-88a7f53d7336", "comment": "Malware payload (RustyStealer)", "value": "4a41291979ce387fd5470ad5afd9db2938669d813f7da7f43dd9f53413457399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042271, "uuid": "9ebf2abd-0976-4618-af1c-aa36a6a00571", "comment": "Malware payload (RustyStealer)", "value": "bced673ab0cf6f008264c763f399899471d30a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042271, "uuid": "046455af-b216-4d01-a25a-0ec58e667f3f", "comment": "Malware payload (RustyStealer)", "value": "208ec8367ea29bc2ffcd9ad7e9753a8ae33c92aeb92c5ae0c9663cc1b70bac5255984f92d2638397776561075fc72c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042271, "uuid": "335b6e3a-545e-4dfd-8eba-e18e53cbcd0e", "value": "T161A56C03F3A581A9C1DED1B98701A775BD7BB88D096076BF0AD34A303E69E944F1E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042271, "uuid": "7ecc4cc4-9450-4ea0-b416-115d99689765", "value": "5aff6c59906e71ba7f18f6b50812a6ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042271, "uuid": "44d27c4a-6e10-4543-b20e-e3c9071e6769", "value": "49152:qgWujJn1BC16aiei88HqTCTELZjrxlGsRTcXDT8Jh8J:BWujsi88H6yvXAhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042271, "uuid": "4103c078-d5b3-4127-943c-49e86eb289e0", "value": 2128384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042271, "uuid": "daf351fd-aa83-40b6-929e-1f0a2b3dd381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042271, "uuid": "a0385c68-0012-4d36-8f1c-15753edf4d07", "value": "test_decryptor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac5f68a-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006111, "uuid": "fe9468df-7f78-4a02-9fad-6adb47122cd2", "comment": "Malware payload (Mirai)", "value": "55f6ac7d0e65b78273d70443186bb623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006111, "uuid": "0203e096-8010-4517-8b56-07d45125e1f3", "comment": "Malware payload (Mirai)", "value": "4a8af19872a460ed85df7e9d13dc5c4344b03cd67fb8c507a18654f4202b3d78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006111, "uuid": "aae807f3-4944-4d46-9759-cd9a4ed33df3", "comment": "Malware payload (Mirai)", "value": "787b2fd1e6ef77da6fd78552852c861c635703ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006111, "uuid": "beec511d-03ab-4b49-8e73-fffbdf35cfaa", "comment": "Malware payload (Mirai)", "value": "ba18092726a8442ae0dde29e66277d2455a42ff2db1bc1b87076cac495febf48994bbb0a12b936f39d90c26b0da2ce08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006111, "uuid": "e759d5c2-cc4f-4953-9157-4d52ecf1ae4b", "value": "T1D55103A91FA0393FDE2ADD370519DB5923DC901F92AA6F466324E9007D0B7486BC389C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006111, "uuid": "8433eec8-a663-4592-8e0b-687bead62422", "value": "48:/ETnBEx02WsDqWcmmzpsoiASJbdNXawZ/0X1rz9syyn8s:/InBE0s+W+zps4SJxNXai8XxRsyyn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006111, "uuid": "411a1798-6180-4347-8df2-76b1d30f3f78", "value": 2844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006111, "uuid": "7d8c163d-e5e8-4544-a646-22010006dfe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006111, "uuid": "ab0330e8-a62a-4870-b1c5-068d1ab6ef6d", "value": "dlr.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ff305b-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042210, "uuid": "9abf6ed8-3524-4e20-8613-5ebea3dff0b5", "comment": "Malware payload (RustyStealer)", "value": "17f4bb4f9b5cac9704f602d0b9c0b8b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042210, "uuid": "8461d15e-7da8-4ff7-b478-676fa9e60338", "comment": "Malware payload (RustyStealer)", "value": "4ad654a8bfcbac5b1816995c2114790a5dec84bf6858e39b15021f5148e84bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042210, "uuid": "45f8d1fa-4a77-4895-a650-97c83830929b", "comment": "Malware payload (RustyStealer)", "value": "cf687bf0e7446a3c0647d5c1feabef10ce558682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042210, "uuid": "61844904-9afd-4101-8db2-7b201863e534", "comment": "Malware payload (RustyStealer)", "value": "f8bc92c3cfb976f1ed59f0f141408e9084420f7e2bcb682d6b5ce0e39f228293904c2feb335d7dd61330ddf3bce5f833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042210, "uuid": "21a17ffb-c3a4-4017-9778-25dcdc2ba75b", "value": "T197858E03F2A581EDC09EC1B48347AA37BA76B4890520B9BF17D55B703E6AF514F1EB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042210, "uuid": "1022368f-c997-4a73-a220-aad8886e6a33", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042210, "uuid": "7e156b89-9d73-4ee4-bf9d-8f485a1654a6", "value": "49152:09WlpKC3hAn+POGSym2tThC5QJPdEks8piJ5:VAn+POGSy8YP3RiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042210, "uuid": "eba5f99b-396b-4914-9108-e0b70adfa879", "value": 1717760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042210, "uuid": "cabc72ff-9104-43f8-af01-c11ddd25e075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042210, "uuid": "343e9fbf-6f77-4d61-8893-19b7291e7662", "value": "enc_pervictim_panel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec7412d-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042250, "uuid": "3ab1b6ad-662c-423a-845a-360e17288f1e", "comment": "Malware payload (RustyStealer)", "value": "a38fcc61011cb37e6afdf4e16b3335c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042250, "uuid": "14482aef-e93e-4a0f-af24-b3ff2022b324", "comment": "Malware payload (RustyStealer)", "value": "4b068261974cfe0001d849f59026f7f3f7d6959c6eb0a87a415cfdb01058ca7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042250, "uuid": "70aa5122-bc02-4b70-a436-4ebac4d14a6e", "comment": "Malware payload (RustyStealer)", "value": "8f17cc5157914069b450ffa6c72148381656524e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042250, "uuid": "f7b64593-6656-4474-88c5-2fa148d53158", "comment": "Malware payload (RustyStealer)", "value": "db39d26b5fb6aaf6fcf6562efaed711819d9bdc5049b4072ea14f329797667b73837c34b304595218239cde4dce07b26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042250, "uuid": "062e06a4-5638-47a4-96d7-f6ae36b33898", "value": "T1FBF6E8E85DC858A1D257F83976997EF411323197EADB1E90C37CF9610D7EAB2AE0090C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042250, "uuid": "f7cf8f54-b39f-4dec-898b-c7cdd330f874", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042250, "uuid": "250be434-966f-4f6f-99ef-db02b6032ab3", "value": "49152:zMe4BDCy6+TbpmhQGSyqQxcCkfe2VR0WhTP6V8fTo4:zMe4yQGSyYRzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042250, "uuid": "a50f854d-01b2-4070-a8a0-4e25ea8f0bc9", "value": 15570944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042250, "uuid": "112584fa-8629-4203-ac7e-21248584b26c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042250, "uuid": "6278f559-f856-45f3-9a4a-2ed7eb05402e", "value": "panel_build_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee625642-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038652, "uuid": "5f582619-484b-40a6-a579-839e0a69ad29", "comment": "Malware payload (Mirai)", "value": "c7c55a739e0861af882f7af03506acba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038652, "uuid": "4f523395-70cd-4f58-bba8-1702543c5c08", "comment": "Malware payload (Mirai)", "value": "4b909d436efdbc3a4aed57e6e4f36a441f6b6ab5dd34179074e32fe544601383", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038652, "uuid": "ac05ecc8-5d15-487c-baba-84453de0f75c", "comment": "Malware payload (Mirai)", "value": "97660f7990a18e8c4054efc4670dfa76a3142f76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038652, "uuid": "16d270b2-32ff-44e5-9ebb-8a876c2f7e24", "comment": "Malware payload (Mirai)", "value": "b704d21dc496aacf67a24164d4242cdf40349e84d91c503a17648fa45992e3544f636a167e1c4642745281d8de13397e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038652, "uuid": "5d0eb614-46af-4c6f-9f03-0384ab3dbf01", "value": "T1A5A3198A78415A26C9D423BEFD2E018D33232FB8E2DE3216DD156F1077DA95B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038652, "uuid": "daec1a36-5966-4226-9db7-81f267dce38c", "value": "1536:8XnIF7+r4kEC+81CIORj/haqOu0N65wFgLm0xOZg1Zo2OPhCg1KY1yGnMOE0YAcM:zOFfE7HmFKqgfOZdfYrkCWhxw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038652, "uuid": "1d6ee900-c25a-4c58-85c7-cd4ba29df6d3", "value": 99036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038652, "uuid": "d7aa22b6-cbf0-4134-913b-edd094453eba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038652, "uuid": "a861dde0-39ba-4fec-80f0-affce47e3c06", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7a0053-d2b9-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1765035612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035612, "uuid": "a4017953-7a9f-4b92-a767-f0a6f0e52fe9", "comment": "Malware payload (GoProxy)", "value": "52459ea12fde72f300f72903b60c7814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035612, "uuid": "b18e5bd7-17b3-4556-af0c-bc6e9994e6ae", "comment": "Malware payload (GoProxy)", "value": "4bad74e5dda5bdc09314703c619b5148e34d001282d94d7cb6cbec3cacf07ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035612, "uuid": "2bbedac0-23e2-4c37-b206-3433d6615ed5", "comment": "Malware payload (GoProxy)", "value": "686478de25034a2cb8bc5c17b9b5740bf063ffb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035612, "uuid": "09dc2370-1b70-4f26-9d1e-656ea694b664", "comment": "Malware payload (GoProxy)", "value": "2a371b38c312e337ba35dc6f47479e92cb2101ffe87394c847e6960f870e85d9c70ababb3e39107eb5f300b2d61d18c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035612, "uuid": "cb962510-614f-47ef-8c77-af20ef4a7cf0", "value": "T1BF765DC7F89034A8C0A9E335A5639192BAB13C485FB163D72B52FF282F367D06A75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035612, "uuid": "3f14c1a7-91c9-4faa-a04d-5f46ea33024a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035612, "uuid": "88b68570-458a-4452-b53d-3e2a83e984b2", "value": "49152:3ATheTumRcwm0sEyvbVP88fS4Am23z5jDco9C+qjZU1hTAeLqnLq5l8HqyInbCrh:3SwiGO23BJ80urVO9ER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765035612, "uuid": "9da41316-c131-4465-bfea-9799bc79e62d", "value": 7675908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765035612, "uuid": "0cd8448d-23c0-4fd8-a2d4-2b54adb87d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035612, "uuid": "79efb3d6-0b5c-4db8-915a-528c42152f6e", "value": "4bad74e5dda5bdc09314703c619b5148e34d001282d94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780d14ce-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050050, "uuid": "6f5d5ae4-e234-489f-89ff-3a1e3d310e35", "comment": "Malware payload (Mirai)", "value": "e6f037dc36434a2a6257039dc8091c38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050050, "uuid": "b4418282-affd-4eec-a40d-4da42df5d173", "comment": "Malware payload (Mirai)", "value": "4c49d3190d48680f855849c9b1bbf4ff155346f408a9bcdd65f7f001fae1d446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050050, "uuid": "bc6e1c17-a58f-4e6d-85b6-ba5845147b75", "comment": "Malware payload (Mirai)", "value": "bd1819b2a690e53180ca457173707f3ae3a1e266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050050, "uuid": "6b1f041c-881b-42b1-95c7-b5eca242add6", "comment": "Malware payload (Mirai)", "value": "adfc11bb9a1aad13ae1e35eb8c34843016e2fcb4ac10b30cf4b7bd064cae4e4bbe8f9247d25356cc1898bcdf2c151844", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050050, "uuid": "b7cc0edd-59ac-4e63-9852-f8a69735aeef", "value": "T19903F1316A6DA091EF7048B4AFBA6ED1178B16FC90F43131CA107F7C5E4214A59BCD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050050, "uuid": "6f32c5a0-6fd8-47da-9626-c55ad15bc7c0", "value": "768:3NMEivTkhRos9IMNxkXDpImu6nqalCW8vXb/AK+H2huNPhHFKjDF/pEbbMcs3Uov:+BTkHos9LxkXlImu8qaYW8/b/AtWhuNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050050, "uuid": "3ed1377b-6e00-4e74-ab3d-22e365126094", "value": 40884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050050, "uuid": "81e4d10f-e1c8-4d9a-ad2e-f96caa0d86d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050050, "uuid": "abb85ac4-9478-4b69-8c70-313c7652d289", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c61d69-d247-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764986586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986586, "uuid": "8cc3191f-5345-4a46-a4af-c16f986cc9ed", "comment": "Malware payload", "value": "9488838e8cacc7a34e77c345ac324fd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986586, "uuid": "53057200-15d8-4b3d-b043-4f3b344eafc4", "comment": "Malware payload", "value": "4c50e551452e17baaf85040a2797dce2cb1173b36d781e30dcfd92ad06ed5c39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986586, "uuid": "89c2cac7-fca2-4b46-88dc-0d95c0be6457", "comment": "Malware payload", "value": "49a28eb26efcf0410892df3a33f7ca09579570ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986586, "uuid": "5a595681-6d30-40ef-8360-7f8f8e0a0b13", "comment": "Malware payload", "value": "7faae309f4e18771b6244905b478333bed43e0b2f284b51ab0ce41dc408e3792d8b5b16616eace68c52845986ac31001", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986586, "uuid": "2215b7ec-7c40-4d73-b93c-f12530bfbc30", "value": "T1D822ED17F3E5DDFFC8AA577409A713703223C836DB428783680C46547FAB29E6EA5644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986586, "uuid": "46469ba2-76d0-4019-a9f6-19f8185c0826", "value": "96:B74+elu6BS8TddeqMOCtsVVQEnqN42mqMf7q1aiBcNQ2yMBxdxefnbuP:Bso0dxCtsVif42QfagQ23jdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764986586, "uuid": "feb6bfd3-6401-4639-978c-8e04454ecd4a", "value": 10768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764986586, "uuid": "7310466f-f607-46d2-a5d6-0f3e2bd93bc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986586, "uuid": "2924cbb7-031c-4347-b978-955bbbeac799", "value": "linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a39978e-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061247, "uuid": "707c691e-3a62-4cc3-ab1a-3477d65cd236", "comment": "Malware payload (Mirai)", "value": "4fbe5832abcbdf5c55c99c869f7af3df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061247, "uuid": "19998e58-9113-4062-85d7-0c3080490e3c", "comment": "Malware payload (Mirai)", "value": "4d1a0cecc47ff3700bbdc8aaa4e8caad8f66484b5eec10f2db1c80fbe76ed4a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061247, "uuid": "b36a3c5c-0cdf-4512-a5b7-3650a6ae8c58", "comment": "Malware payload (Mirai)", "value": "e8c10fea4f556ad7ce6451402d5bffefa2a2db8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061247, "uuid": "2f69c5da-5442-4c7a-931a-68b6f1b24f90", "comment": "Malware payload (Mirai)", "value": "71ea249f8b9b5c3172038d17041b19a8b5f5bb45f718d93513dfdc560c0ffd7d7fed5be41994568a2e1335c4a39e4a9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061247, "uuid": "cd71798e-50d1-46d6-ba50-ffad89dc6b8a", "value": "T102730A95B8818B12C5D512BEFE1E118E3313177CE3DE72229D206F24778796B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061247, "uuid": "a4a60178-699c-4a1f-acf5-f73b02900ca6", "value": "1536:A7nrnKV23CVzIRWrZhGt9ha68V0OQtM+ir1i/+kx7ov51YMd:uKw3OzI0nGt9ha6G1i/+kxEv7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061247, "uuid": "2da038d0-56f9-4427-b9be-66b2269420a2", "value": 80500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061247, "uuid": "31493b37-48e0-4d58-960c-8a9e04ce73fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061247, "uuid": "99bde40d-b84d-458f-bfb6-79763ff4eaad", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8fc4b4-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042217, "uuid": "75ad9bc9-c3a3-4bd7-91b8-4e825cc43cc6", "comment": "Malware payload", "value": "1fe8b9a14f9f8435c5fb5156bcbc174e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042217, "uuid": "9b40022a-b5a5-4972-ad8b-f3fd0767a2c1", "comment": "Malware payload", "value": "4d1fe7b54a0ce9ce2082c167b662ec138b890e3f305e67bdc13a5e9a24708518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042217, "uuid": "41ff93c2-a443-46b5-87d9-2b5b65ce3ee6", "comment": "Malware payload", "value": "bc0788a36b6b839fc917be0577cd14e584c71fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042217, "uuid": "30460fb2-8513-4f52-8a94-77beaee37c5f", "comment": "Malware payload", "value": "5ab9c8a849213f9642faa31644eb867b00dba40b73367c4b9b263debbb8059796e591a3a2a0d49a53e728bf9cb9f25e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042217, "uuid": "70e8319a-685f-4200-a933-ecdebf5ccd05", "value": "T1A5F6E8E85DC858A1D257F83976997EF411323197EADB1E90C37CF9610D7EAB2AE0090C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042217, "uuid": "ea7ff43f-d786-4395-ac14-e78a8c8b3a30", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042217, "uuid": "082c8907-2e45-4f3c-899c-171b62e35dc6", "value": "49152:jpYoGC86b5jgHGSyvWF1LAWfxdddUuQ8EwFc:jpYoEHGSyoBLmfwFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042217, "uuid": "7f578c1a-eded-4a26-b0ba-fab63bbdaf81", "value": 15565824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042217, "uuid": "f65fb4d4-137a-4b4c-bdbb-cb84c43b3c50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042217, "uuid": "a2377f49-357a-492d-8a45-ec04b6390ef3", "value": "full_test_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbdb374-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049170, "uuid": "8791b4e5-d39d-41dd-a2aa-78211eab822a", "comment": "Malware payload (Gafgyt)", "value": "660859ecddc1c29a09449c3eec298d98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049170, "uuid": "bdf417ca-b3f9-4524-8842-4d8bf882250a", "comment": "Malware payload (Gafgyt)", "value": "4d6b4e747cc13d9ed89873736d6c69772389b8d13448ec6493d62312295dafe3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049170, "uuid": "d64c9dff-8c8e-4532-8aa1-685ae3b4be4d", "comment": "Malware payload (Gafgyt)", "value": "701a8c36f5a645fdf7a09e24559aee428181f1e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049170, "uuid": "0f978cde-8b9d-4f55-8c49-1b5fda4e1021", "comment": "Malware payload (Gafgyt)", "value": "ea5c699b729257d9149095e06466af35d341561b695dd67721ffd1c56b9a5e59466b7ec4d1fa9ec8f718af9f8d49be27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049170, "uuid": "360b4987-d8ae-418b-ac7b-3a7a780d4c13", "value": "T191832C43A9A19FB7C0866A7165AB5E300B13E9912B4F1A4A713DA7F8434F4CD780FF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049170, "uuid": "6a44e031-974b-4557-b53e-282c328aba20", "value": "1536:eJNxUyGLuEv0kBxoeKCg0KHfCBC/S3IW7R7mkxVqOEeofzee:IbGLuEv0keCPB4pc7mkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049170, "uuid": "103528ad-8fb8-4c4d-b77e-39ade633379b", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049170, "uuid": "0c5dfe42-0f27-43bb-953d-404defb27bd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049170, "uuid": "b78c4e4d-55dd-446e-b5e6-115f67d344ee", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3748186c-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043499, "uuid": "648eef34-af40-4cdc-a688-eb7c80c6831b", "comment": "Malware payload (Mirai)", "value": "cff5ec6873c426f2de1c4f48fba08a8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043499, "uuid": "31a8efc9-e912-41a2-871f-eb3672b4179c", "comment": "Malware payload (Mirai)", "value": "4e3ad44b1299ddc873e17d5730f7f89e49cdf340dda126a6f9346fd342b2e2e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043499, "uuid": "ec354ae5-511e-4721-9273-7c1646b98edd", "comment": "Malware payload (Mirai)", "value": "40f31b675fe50b58507eceb1153cebbb5e398298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043499, "uuid": "7c2e6e48-b642-42c6-af35-8f6dbe01c95a", "comment": "Malware payload (Mirai)", "value": "a304ef17efa8b675595e948dd51fbcef070c9e81f722792bb87b5cc92073fa55aee0c299dc05f434a3a516ec7906aef1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043499, "uuid": "667cbeaf-9937-4a6c-b52b-53a9ec24d577", "value": "T187E32A46E7408A13C0D6177AB6EF42453323AB64D3DB73059928BFB43F8679E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043499, "uuid": "c91e9dd9-87c7-469e-a660-e87a4257ba51", "value": "3072:TVu+Fe4XalHzbx8PogNLCz7QHE8E1LNJmM/9KIS:TVu4XalHzbx8PBNQ7sEH1LNMM/9nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043499, "uuid": "9e11e945-bbca-4819-95cc-5c7bbd612b37", "value": 154279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043499, "uuid": "3f654b74-6b3a-4ec4-be88-e1aa4fb27bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043499, "uuid": "17b24be9-998c-4843-962a-78566caae4e3", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd6394c-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042137, "uuid": "7ab9c1b0-9d33-441d-82df-aa4eb28e3574", "comment": "Malware payload", "value": "2276eb4086c37db0d4e945c71882c644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042137, "uuid": "e645e554-530c-4e57-877a-887699bbfab4", "comment": "Malware payload", "value": "4e856041018242c62b3848d63b94c3763beda01648d3139060700c11e9334ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042137, "uuid": "2328e6a3-3bb9-4e09-a6c3-309115a56b8e", "comment": "Malware payload", "value": "0d59d5c38539c6d9243271e4d91691c78265d7a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042137, "uuid": "d94a4e61-2c69-4993-9f68-2a6a00132eaf", "comment": "Malware payload", "value": "cdfaac4c0ec809594bebf09e8843e59fa32dde02225054e7da1cbf553a9039ad47ff86672be698b604dbd7051bd8b566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042137, "uuid": "4c1c74d5-a2ca-43cd-8e21-55341b3ba034", "value": "T1CD664A03ECA545F9C0A9E5308A669222BF717C495B3127D32B50F7382F76BD0AEB5724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042137, "uuid": "544ac24c-3dd4-424b-bc16-79f4219883e8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042137, "uuid": "00b3a916-1a8b-4b8c-b74f-efef10b503fe", "value": "49152:fZCNaWNPNA2/ZFrxs2IeJcBfdZCUNyFojVSo+1QuggKVXRwTLwwWwVm6ocfM7Hfq:fg2RaSyOVSoizvTwmQHbntE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042137, "uuid": "4645e23e-e838-44a5-ba14-1cdce1fb027b", "value": 6613504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042137, "uuid": "a8a11125-cba8-4ff4-9e7d-ce9edcece498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042137, "uuid": "8ecf90bc-e793-4118-97dc-f2c1915be84f", "value": "agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ceb6de3-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061198, "uuid": "77bb5e0b-96ec-47db-9b13-b301bd1a0d40", "comment": "Malware payload (Mirai)", "value": "e6c4f67ab54b7a269bbea9390e63f3f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061198, "uuid": "6968f075-3c4a-4b13-9b0c-0121deb32f93", "comment": "Malware payload (Mirai)", "value": "4f0c6786fc27f9b8f96e3f43b433bc8d3917c623c60d3c9ece329558a6231255", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061198, "uuid": "462fd404-d9fa-4193-82be-d71332e7fa9e", "comment": "Malware payload (Mirai)", "value": "22a556fe4b4940b3da4fee8cebb3d3c4faf788b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061198, "uuid": "3a909a0d-5118-4d84-b46c-940372f1719c", "comment": "Malware payload (Mirai)", "value": "2b6bd20a2e95578a6133483bc142e7020edfb34c4085e9a4be517c397fa4b55a3a0d7d977799b05368e5da5cb1bbdd12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061198, "uuid": "51d86d89-245a-4346-8e6b-227d3dba3607", "value": "T1DAF2E13C91557E8FCD2CCE7C9ADC1BE69A0431E037ED0B1D92E05C50AB6871BF5198A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061198, "uuid": "725eafa3-9d3e-4485-afe0-30ef15632618", "value": "768:7zjoBFAKHSzHZMTNND2eEV7I4L8+BIpMg1nDgQdu8BkRWy:XM7AoSOBNIVk4L8cIpMg1nTk8Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061198, "uuid": "d1080bda-be5b-44b8-9c53-3bd849503b3d", "value": 37488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061198, "uuid": "a78baf32-b5bc-4713-8530-6d6dac51d1c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061198, "uuid": "32de7930-f349-4610-b319-df33171ae43b", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3899103-d240-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764983658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764983658, "uuid": "857da714-49c2-403b-b76a-dbab837cdcf0", "comment": "Malware payload (Mirai)", "value": "0647a2725a4ca2c4807ed1caa50c7063", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764983658, "uuid": "961ba90e-2465-47e0-9af9-890de503ea6a", "comment": "Malware payload (Mirai)", "value": "4fa72cc7c4a63185e0232efee46d3954a73087db47ddd125c8681cab9f397b5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764983658, "uuid": "c8cd7f4c-01d0-43e5-88b2-223ed849cc53", "comment": "Malware payload (Mirai)", "value": "59b78d5f4156986c72c782d422fc0b03c478d3a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764983658, "uuid": "e6ca0380-9c27-4af9-8223-315889febb81", "comment": "Malware payload (Mirai)", "value": "09fe6c1eb86064b483f5ad77ec6ff2b80ab6d3300a2bf1f0ffccf14803adb03e9ccbb4a788deba044751c9651a710d68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764983658, "uuid": "c4ea9888-458d-4a17-bdd4-9bce4cb93642", "value": "T1C8A67C4BF5A358ECC09AC430475FD663A931B89442317E7B3694AA342E77E305B6EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764983658, "uuid": "764b3ee4-999b-4cb0-a3a2-966f9748393b", "value": "98304:6DzWLfrBIe6uK1JcVb28DTYtxeOmJosFNQ98s9PEqlWmEfpIawQW0OZkG4ckRUaT:6IsuKpE0SUa3Gn8gMB+5qNnIFzAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764983658, "uuid": "5ca6e4c2-1383-4c1d-8710-4454f4b55ae0", "value": 10162888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764983658, "uuid": "300445ac-a50a-4d75-973b-b6583022247d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764983658, "uuid": "0774e0b6-5470-4659-8528-0d1cc60bd965", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3056102-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048914, "uuid": "c47c3abe-5be8-4506-9670-f9ad7da63213", "comment": "Malware payload (Mirai)", "value": "42458217a3998540216390e8580aa173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048914, "uuid": "9e17e88b-d9fc-4df1-a182-fd0b7c5907f8", "comment": "Malware payload (Mirai)", "value": "50e1be7a0afa917952bb6d5951543c81d8575274d026e2bbf7e4ce93ee0ef263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048914, "uuid": "6b155e60-eee0-42e4-a22b-ccb8bf6e5758", "comment": "Malware payload (Mirai)", "value": "e9db9b1e7be13854dbf696f3c469badc4d61fb85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048914, "uuid": "713584f8-48ba-4921-9679-1039ef9db7cf", "comment": "Malware payload (Mirai)", "value": "5003c59d348fb429624c779de79d6c7e9e18d1e47ba2756f7ed84a6096b70846baca51e639161e444d200f005ead1cdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048914, "uuid": "d8186223-e2c1-4529-8787-207fc27a24fa", "value": "T118045BC7F800DDBDF80AE73B4857040AB130B7A644825E377267B96BEC7B1951927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048914, "uuid": "009649be-cd3e-4b83-ba7a-36c28f37c3a7", "value": "3072:4hQXdTDkoLzNKpNsoRpYZBsyTS/H8AUPTZQS6birVejbi0mLVdCkhP:4CttLzNYCnZGyT6H8AsTi7bidL+khP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048914, "uuid": "c94a5c0b-d162-416b-a4cc-cf762154e5a1", "value": 178336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048914, "uuid": "40e42a5e-f5e8-45a7-99c3-4218e5e79b36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048914, "uuid": "2aa01499-3e94-45d6-ac13-7e58559bf117", "value": "jnaudsbsgdibfhfhdhdhfhf.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0041852-d2ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765042869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042869, "uuid": "f08fd30c-cf2c-451e-ba91-c5af7c432209", "comment": "Malware payload (Vidar)", "value": "1176f807a42ca61adc2be908a8a6f8b5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042869, "uuid": "d25edfe1-d0bd-4b9d-b8b0-99926b2b5a65", "comment": "Malware payload (Vidar)", "value": "50e5f662d756d74f9dc7a2f6a5395a2ae07049987fc4f6816d4e429212d2bd01", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042869, "uuid": "18b461a2-1e44-4d03-bde6-94f0a33ddb4a", "comment": "Malware payload (Vidar)", "value": "aae0588913a044caccf11f3a64bab2cbba4f8415", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042869, "uuid": "1a28605d-0dd1-4afb-96b2-abcfd2cf9be8", "comment": "Malware payload (Vidar)", "value": "fcd13ce2611db2ee6d089a4b3e14344192b56d6c72296f9ca1b87ca1faed7f74cdb8a61d11d3b0d0ade50ac5632caa2d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042869, "uuid": "2ecb8289-0a19-43d3-944c-967ba6ed663d", "value": "T147862962E991052DCAAAF331E45152D07B30FD1843392BD7FFD88A550D2ABC8273EB59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042869, "uuid": "d2835b7c-5538-41fa-b968-28aa8abf5131", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042869, "uuid": "22b85bff-5547-4796-acf9-c35f4930d8fb", "value": "49152:pjAhl3u0k8d3iSqGRkUTIx0FN/6HcS9+/KmuxyT3wl7XqvytJOJtMRt8AIYXLK1j:ol3u0UM/d63vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042869, "uuid": "adc88b73-eb53-4f7f-959e-d57dfaaca343", "value": 8336512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042869, "uuid": "2125db21-ef65-40e2-9f14-dbc79ae42314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042869, "uuid": "c66a5ad6-df02-43c7-bc76-cb0cb26115eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecba3afd-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048957, "uuid": "68386ff6-53e8-4124-be48-90341d3c5e4b", "comment": "Malware payload (Mirai)", "value": "c2871201afbe4ac9afcfd3792f358c0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048957, "uuid": "c57cf7d1-e6a7-49de-85c8-65304eb91849", "comment": "Malware payload (Mirai)", "value": "5155504cb759423b87411e80ec908ad86feb2997a75a84938777f71e4be9533e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048957, "uuid": "129a4b87-1bfe-479e-b0a3-55ee7ed44cf6", "comment": "Malware payload (Mirai)", "value": "f1379245aede73e8f6bc70ee10e6e8d6b2b4fafe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048957, "uuid": "43e44277-137f-4b37-b8b1-7551c1d92a96", "comment": "Malware payload (Mirai)", "value": "551618769ca462df631aa8c6ff84fe943d43e2eda6712c4ab30a86d9f22035923fd40dbe1c752b3d54f8436b15f23836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048957, "uuid": "a837e02a-f3cb-4301-b916-e56f50b5cbf4", "value": "T127F3B50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048957, "uuid": "6b7a11c6-0e2f-4180-8016-d85f818f3def", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiw6:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048957, "uuid": "7574bdf1-6186-4de0-b7df-d88ffdb84d18", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048957, "uuid": "43214522-dd14-478b-82ce-9ee58ed81551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048957, "uuid": "f364171f-ed65-4353-9537-baf4fda4592f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac7357f-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048954, "uuid": "54c8dbba-885f-413c-9f56-6c1371a15b3d", "comment": "Malware payload (Mirai)", "value": "b2e3fda1168d31156593d73da42027ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048954, "uuid": "fa7c8cd4-1ccf-44ed-9ec1-b04e6a9eca91", "comment": "Malware payload (Mirai)", "value": "51bda3f047b2f361c205f4f96a604473c27098efb8b37ce3670a17fec22c7b76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048954, "uuid": "2d82a29f-6b60-49d7-baa3-402c93d334c9", "comment": "Malware payload (Mirai)", "value": "cbba81a5bb7bf99194363fc07c26037640cb0d6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048954, "uuid": "e73491cf-b6c4-4295-984e-b7b44ea5c4d7", "comment": "Malware payload (Mirai)", "value": "05464e77e901a16874ed80f0e3af996caecfeb0413c59e1cecd44f49a2f764873e572723961a9636f1ec338111a150c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048954, "uuid": "54500899-5c35-49ba-b94a-48c8b855aa6d", "value": "T18873A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048954, "uuid": "268b5e33-e087-4a29-9bb9-52e02dc8c750", "value": "1536:zoVvPLWTs7ys6XcniEyNMV3sDmTRdVSabdza3TTLbwXmP52:zo5WTm6XouMV3sDmTvVSabQ3TTLbwXmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048954, "uuid": "5068cfca-4795-435c-96cd-133d14a477a7", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048954, "uuid": "76321700-05a5-4aad-972b-b8144eaf9fa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048954, "uuid": "eed88f01-ab95-4a32-aa67-7311dcce0069", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3f22fe-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061200, "uuid": "a65fe83b-5867-4c4e-ad17-f4967c83056a", "comment": "Malware payload (Mirai)", "value": "d6fadea33b344041d5a42e600484972f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061200, "uuid": "d76eedd1-20c9-4acf-a9c4-d163caae5447", "comment": "Malware payload (Mirai)", "value": "51f53a336067786c468be23174b5490e0af7b75cdb2394dc6861943bbaa6a842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061200, "uuid": "b7294423-9b96-417b-8a22-27132726b234", "comment": "Malware payload (Mirai)", "value": "6c4e4208737d1be2218f44701450110375b07dc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061200, "uuid": "d401578a-cd37-43b1-9313-b14baec65e87", "comment": "Malware payload (Mirai)", "value": "1e3ae7dde243925d5263109e822468ffd87af64ce491b44803b6c4bbeafff3f8bc7a4aa812d322ef82c916ca96638a24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061200, "uuid": "767c548b-cc76-4e51-b29f-a9e18c56ceb3", "value": "T1D9539DB7C8296E54D19881B4B8308E741BB3B58492471FFF1A9AC6B99043DBCF6093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061200, "uuid": "10e321c4-646c-415f-a503-fc828c4422c2", "value": "1536:0aZwtGCMFmlIiI5bKCKmCYSaNC3MPOMofco:0WGM4lIiQeC1SaNJtGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061200, "uuid": "c66e2395-d1ad-4b94-8bb9-d0327d3da5a0", "value": 63652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061200, "uuid": "b85df75a-116a-4d25-8bac-c6f52e34e789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061200, "uuid": "a977b097-71ce-4a31-9147-befa4fb1d781", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f1a6b9-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003120, "uuid": "b318a62e-232e-4998-ad5c-267c40200332", "comment": "Malware payload (Mirai)", "value": "330cb4eee1a70f4a8b54410e7f50045e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003120, "uuid": "8f7e8146-c1cc-4a3c-b518-bf973785d008", "comment": "Malware payload (Mirai)", "value": "523fb42f240a7f7d1e976159fd0f5cce48eb8646b9c4d81c21e4d92f10ea0e48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003120, "uuid": "a249b119-99bb-40d2-bf9b-884826d4ec6b", "comment": "Malware payload (Mirai)", "value": "ac04ed735d5c0613a96155fa47432ebd0e7680b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003120, "uuid": "f8932faf-97bd-4d48-85dd-ba130409e941", "comment": "Malware payload (Mirai)", "value": "67c793a786d63b4bddd3e9774e45cf7c8d2f9022340017f92ee2400a468e393e39e45c65ff40bf281b88fc842ffd1406", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003120, "uuid": "a0f11123-8e31-482b-a85e-3822e4aa5382", "value": "T1D5A3098A7C415A66C9D423BEFD2E018D33132FB8E2DE32169D156F6077CA91B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003120, "uuid": "d0cbe57e-4b13-4a43-b46a-f9aa9f2068a0", "value": "1536:oPnacby00gGFs+GyGgzs8FakVpauKwHxOgpMMxJCCwmXRgCKFNenYLgrq+wOv+B2:8byZJ2lUFROHM6t6gd2oWBepGhmpUDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003120, "uuid": "c6f7b71d-4e7d-4fcb-a222-3965ea968cff", "value": 103136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003120, "uuid": "c6f3a921-d6d6-4948-9bef-2b718ce45231", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003120, "uuid": "da6ac278-72c5-4e4c-b55c-175f406146bf", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a098fa-d24a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764987881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987881, "uuid": "dc8c6190-3138-407f-952b-65e8f8ec07c7", "comment": "Malware payload", "value": "0b3041f677317f47991ba50204c74753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987881, "uuid": "7f9e8b6d-30ce-4b63-93e6-a2653ce13499", "comment": "Malware payload", "value": "5379020ca83b73e0c9cc731a24ac39be6645f0107bf754fb4af1cc63e78a8f19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987881, "uuid": "e6e14d34-6702-4aaa-ad79-4f2e4562b967", "comment": "Malware payload", "value": "bbe2c21e847d639dd569e1ff273df1f5870ed60f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987881, "uuid": "74ca67cc-76c6-45eb-956c-60e5162b339c", "comment": "Malware payload", "value": "e1e3513c6674b6b21a0c2be2449645e580dc03cd969967aeabb5c5f44a84c1ed3bcde42ba35391e421695a1be20f1e16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987881, "uuid": "edbc01ad-10d3-416d-9ea6-0e532f1838b1", "value": "T1FC42C0C8BA45FAA5F6145DF27C2C01BC8A9BF5AF0A76307088D5F84DC6058AB1D0E3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987881, "uuid": "e9c5773e-2295-4804-86c6-fc2a39e2e09c", "value": "192:fTu2PzRurki7SLDLVpVovt9SbVySN6TQ3JuGpymy/qD1zIWRzYFbYWvpK9pGr6:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764987881, "uuid": "4020c0ae-125f-4429-8b0b-1df77fdab813", "value": 12852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764987881, "uuid": "913b6e03-4dc6-4032-82d0-ec2bd4b29a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987881, "uuid": "a663cca1-359a-4c41-9841-e924189365e3", "value": "SecuriteInfo.com.Linux.Packed.2018.6236.23403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8be1d1-d2e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765054030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054030, "uuid": "0fb2f17c-9a98-4bbf-ab82-70f85ce5b9b6", "comment": "Malware payload (Stealc)", "value": "b83ac9a525ee2ed6c399519a969063d8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054030, "uuid": "ac8dc1f3-a408-4fce-b87b-832af0949c6c", "comment": "Malware payload (Stealc)", "value": "53a4ec3d8e00bb60c891bf45069a2ea5a987382410b76613c7fc7c9407693daf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054030, "uuid": "6de320d0-7c7a-495e-ad1c-a68f7171e988", "comment": "Malware payload (Stealc)", "value": "f9e5e8d5fce8912f8f4b6e67e7a9c2066d5d96a1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054030, "uuid": "447b1389-49c7-4e03-ad5b-5da375414657", "comment": "Malware payload (Stealc)", "value": "d208e1804f61fa22174661fda40d8468abb7594af129f7e0d043bf48245419831fdbbe8037f9cf9d31069c52e2344a3f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054030, "uuid": "8ca375ab-4e07-4655-9efb-8a761eeaca9b", "value": "T1427523B7FF1374D5C5EA04B5885A25F33921AC2719942B77A6F0B2290CD221B3F32976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054030, "uuid": "01bdca71-2aa2-47a0-a703-b9b83279dcea", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054030, "uuid": "46d37689-37c2-4e8b-9647-7784b2e4534f", "value": "49152:CispaohgMmTgvdEHgepQg5/OqR6io8xw:96aohgMmTgFEHgS5/Oi678xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765054030, "uuid": "90c90d0a-1c9b-41be-91db-1ab9c6ec2583", "value": 1595392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765054030, "uuid": "93ad33d4-c1a4-4897-94b1-abf36fa64972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054030, "uuid": "97208184-39d4-4f86-b36f-ba1ea67096ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722c0a9e-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061207, "uuid": "c7d51b43-d489-43b8-b832-a165e3993a46", "comment": "Malware payload (Mirai)", "value": "2f654c9cf2dbd197b281b378f81db8ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061207, "uuid": "6fa28acd-9ca6-4b16-9a8b-02049e7abf3e", "comment": "Malware payload (Mirai)", "value": "5516d5ad3fa27a731bc01048569569d6ae0cf27adea9e928c4cbebad9f83c603", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061207, "uuid": "0054106d-bc50-453b-b627-7c62c05103a6", "comment": "Malware payload (Mirai)", "value": "1d4f1e63df34d8ff8438f1aaac5f8956880717eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061207, "uuid": "e037e9c6-4523-44f9-a58e-d62f8f05aa6b", "comment": "Malware payload (Mirai)", "value": "b2fb22b47388b53c68a47a06584a070686b9bbfa7f70d061031fcdac1fbbac1f4c3edf900c6bc07350baac6a46f38ddb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061207, "uuid": "4ea1b268-a30c-404d-b657-457f9d734c87", "value": "T1EFF2F135BB394C74DAB57CB8A979CE059A055AFC817D75B202EC143121C1EC2AEF4A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061207, "uuid": "38776eee-bf24-47c2-89d0-76ccbe5b809d", "value": "768:GyU1MhDcAZG1YVf8Y5Pv077oq7wHNd2ubsovCdqi9q3UELQT:jVcAc1kfz+NEtdPsovCEXLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061207, "uuid": "64c9f839-5e24-43b0-a780-341665807cd7", "value": 37488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061207, "uuid": "73475379-d8ba-4a41-9fbd-e0278ea5730c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061207, "uuid": "351c9d3d-cd9b-413d-baf9-e5867be174c0", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78864e23-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049621, "uuid": "43c3c9ab-6d94-4057-a062-00c3a6b94e36", "comment": "Malware payload (Mirai)", "value": "638a1ddc0f007dbc31edd27d46343eb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049621, "uuid": "2e1b4d3b-e834-4a3f-91a5-e68016a4c5f9", "comment": "Malware payload (Mirai)", "value": "56329ee73b38cd017eee61b1264610c5394be719543117aa8e11286b1519a143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049621, "uuid": "6a4600b5-17f1-45a3-b019-12ec47f5fe4b", "comment": "Malware payload (Mirai)", "value": "8eafb6581d3266c83b9e8aeb614c5a1a1693e79d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049621, "uuid": "c63f90cc-8cad-4845-b377-6aa017ffda7f", "comment": "Malware payload (Mirai)", "value": "6d2628fa41ca4ceef04c2a623452f6d8608ebb342986450c0d4e8b601a8bcf361f3e84e952ca46558895e4ff0e79e9b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049621, "uuid": "30a449f4-a4c3-4095-b9a4-dc990401ae1a", "value": "T123D4C067F6261E03C8E7A23F2567C2594333E65623965706A70BF5B83ED52398F0A3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049621, "uuid": "dc456dca-f5e5-43b7-ac68-154754e8e509", "value": "12288:G4k4/zLC9soyxuoRtFAKY+Lkfd178ppwR4w3BwVswP+nRg:G94q9iooRfSnwVsq+nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049621, "uuid": "23066343-ff84-4a40-8fcb-2d6726566f0c", "value": 600020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049621, "uuid": "beea6382-404f-4bb7-a9f8-8107b712121c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049621, "uuid": "5f6b91db-c27e-473d-ac90-8d7ab74b6f9a", "value": "armv7l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e14494-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038666, "uuid": "d0bb0f3b-e368-4b40-8c1e-5a5194c3f5d3", "comment": "Malware payload (Mirai)", "value": "b5b55efad0954fa05ea6dc2e8684908d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038666, "uuid": "162f3fa4-7622-45ba-aaef-75e838e9beb4", "comment": "Malware payload (Mirai)", "value": "56c68284902b5121d26cbdcf71f5fcd523fe04e0b22744b532f5d020748a49e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038666, "uuid": "10a64193-d332-4670-8996-46f6ed33b8c4", "comment": "Malware payload (Mirai)", "value": "1d4639a539006028f25bcc85da51375f83b7237c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038666, "uuid": "b1c61937-48a7-4d0b-a149-35ae5d0b1cdb", "comment": "Malware payload (Mirai)", "value": "cefd19276b67aff23d0e6b1876061d4294be3b0292cb891235aee8dba1ace51c4ddc7e866fcf3d736fa254c1eb789bd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038666, "uuid": "db40d080-e4aa-4a82-b2df-b3932f1f0de8", "value": "T122933B0176280B87E6E319B02E3F2BE187BEDD4220F47549645FBB4686B1E325487EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038666, "uuid": "752404c6-a478-49a4-9651-f8f20ae6e96d", "value": "1536:iiJ4fWOU0uN79rFpEZrH1CS9rDKiTDV2xL04geQukT/+7t34qH/BrS:0e30u3rrEZrVCShcCu1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038666, "uuid": "88bbd173-832b-483b-99db-0932c010dc2a", "value": 94924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038666, "uuid": "a4906f56-45fe-4994-809c-ec52b93d3642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038666, "uuid": "d98f73cd-8499-4256-841a-284265775140", "value": "j", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745a80eb-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049185, "uuid": "8a9828ca-386b-4e28-8373-326c92c599bd", "comment": "Malware payload (Mirai)", "value": "14183c90b3ba89193f717b2f242dab7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049185, "uuid": "d0ddc56c-391b-4c05-a3e9-876f72995095", "comment": "Malware payload (Mirai)", "value": "578a7d4b2c923fd355b0dde87b33cfc71798b0116a42f6413a0a61bb5b7b28ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049185, "uuid": "44230004-9b01-4b75-95ab-ee7066a0f0e5", "comment": "Malware payload (Mirai)", "value": "19fda07632ba0be014f15b177aa2c365c1d2348d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049185, "uuid": "eabe75b6-463d-4c21-8dcc-0bf9940ddd7c", "comment": "Malware payload (Mirai)", "value": "d428e4a81caf8488825f7d02395c15753ad550b6d70ecb0ac529d6756811e6c5158c3f2dd2d07ef98aac056ade31b564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049185, "uuid": "195eaefb-4aaf-4ce2-ad5d-27c5b8a402b7", "value": "T15ED45B06EF900FEBD4AFCD30452E835B18ED899742C1A73561BC8D5CBA8D2694FE3598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049185, "uuid": "94713b45-f425-4614-9059-69188fe4f58f", "value": "12288:DK7qMeHJoAAhf/Zmt3MVAHTJkpwsI3kt0F7q7W/qcVHVx5jmFr+y+x36l3fm3NYI:yf/Zmt3/vfGomPSWY0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049185, "uuid": "94a408c5-f1d5-48bc-8aab-9c2dd7d298a9", "value": 598128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049185, "uuid": "6cc8e3af-2d9a-49bc-9929-a7fb485f2f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049185, "uuid": "a6760617-2e54-42e3-8414-9826b08b6d98", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e4c0c6-d28f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765017560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017560, "uuid": "3ba5befc-29b1-4cd9-be9f-859aa938d388", "comment": "Malware payload (Mirai)", "value": "c1f2125ed22b109f295551db79f92201", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017560, "uuid": "eb897672-8b76-47b3-8be4-2a44f70bd346", "comment": "Malware payload (Mirai)", "value": "5829cd5b194802e2d26d86bfe1621b71afbb904d0d6faf8d2925e87df87f5b73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017560, "uuid": "9b34b131-4e12-4362-b612-885fa1a05ddf", "comment": "Malware payload (Mirai)", "value": "9fe5d78d52c2d8a8bf5f071f9b900a641b9f4591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017560, "uuid": "b768b8ed-246b-4fbc-b5ce-11ceced5de82", "comment": "Malware payload (Mirai)", "value": "a6b42742377cd0be4284b3b789b38c2ca81a62baf082e9e2e120ce75d78b176ce2a760e6a542f57bd89bcd8105a1f3dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017560, "uuid": "649368a2-3e96-4ea1-8ddf-2e133eae40b6", "value": "T1B8D3F80E7E218F7DFBA982344BB38E15965933C637E1D585D2ACE7011E6024E285FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017560, "uuid": "4867757e-56d1-4e29-9e24-5637bafb3011", "value": "3072:68V1GJyWE5yVkQM+HhyZ+zOpTrSoE5MpP+/qPXv/U1ywZbZAU7mFntlMNRaU8lzm:6q1GJyWE5yVkQM+HhyZ+zOpTrSoE5MpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017560, "uuid": "cf9a9b3d-4efa-4314-b4b4-a6fe3159d723", "value": 141600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017560, "uuid": "5d9793e5-325a-485c-af82-2b46623f1e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017560, "uuid": "098f6819-e0e9-412f-b687-65c311168b5d", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2994e89d-d2dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050348, "uuid": "b60bc56e-c0e3-4578-bf41-28d774fd9fa1", "comment": "Malware payload (Mirai)", "value": "3510d35edc2d0bcc985781006900a56f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050348, "uuid": "21651028-48b2-4898-91bc-fad280ca7c2c", "comment": "Malware payload (Mirai)", "value": "58b6a24847ce6f30ecd378768f15999ceec005d5b18ad88bdd66a30af0a0a39d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050348, "uuid": "e3594c78-398b-49a6-b346-bede598d214c", "comment": "Malware payload (Mirai)", "value": "15860d803cca60c6bb3de33d923da45ec719f8f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050348, "uuid": "80b01373-333c-4de8-a0ef-a8716326de5c", "comment": "Malware payload (Mirai)", "value": "61829a8364fb6d4b05dca61f2cb39b5d70eef32bfc3095b8d5d1e0d3896daf3a020facfa9e76aa894809ae75db5781c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050348, "uuid": "bb53bb53-b5b6-4f8a-a592-231d3030f6fc", "value": "T174B3C85E7E218F7DF768863047B34B21A35933D627E1D685E2ACD9041F6034E285FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050348, "uuid": "0d090105-4c93-4a1a-851e-9222da85e5b9", "value": "1536:pTkwJlCS4RqbYLajrSdBiow1KW5rLRCNW2MOg2TakewrlHDSbABLy:pJ8ebpjl1KW5rLRClMO372bSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050348, "uuid": "9f2ae3e6-53f2-41ce-b16b-711e74df790d", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050348, "uuid": "09281d46-ad77-40d4-b6a3-6edcafc7f3f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050348, "uuid": "11bd9ecd-f23c-4951-bc43-28d5fa4a1f5c", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a62959-d2b4-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1765033300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033300, "uuid": "4afde08f-1fa4-4b1a-84ba-78c19c729ebc", "comment": "Malware payload (Socks5Systemz)", "value": "cc9310c94637427e62c15e9c5ffa9306", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033300, "uuid": "557c4c25-ae66-44eb-91fc-241d176b8140", "comment": "Malware payload (Socks5Systemz)", "value": "58caa93879a267afb27643e6367377d8238b07c921d5659c000cd6ebb0b04426", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033300, "uuid": "683480ee-3f67-4da3-bdae-e1bbbb5be1a6", "comment": "Malware payload (Socks5Systemz)", "value": "ca23e1e0859a2750db11a493522f8c688799b3c7", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033300, "uuid": "1b7ed180-0190-4dd3-a5fa-09387d3d8bcb", "comment": "Malware payload (Socks5Systemz)", "value": "24686167a5e47d455d327f0c49f86a43f4295584917be4f9e02bfb6bf91abcac0d74d4f61d0255130b7102296c1778aa", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033300, "uuid": "0edc18ca-91f9-40cd-961b-7ca4fabf96d5", "value": "T1B8F533024D480974E6F3D97C182AF6355D7BAA751C15132174FCFF6C2AB32F19A2AA2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033300, "uuid": "b350fbfa-3f05-41be-91db-9eb6ac028e70", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033300, "uuid": "403bac3d-90f1-409b-8e30-9fcd7ce5d2de", "value": "49152:C9nLHkj9VFSJ3Gz6IZ4JfO0Z6BZzDJ86N7ZtMeBow5z29V7cAB7LEX9hoD8KX2F8:MnLHETMtI2fO0Z6TjLzPA0JKXIOpXx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033300, "uuid": "e7ea3d01-3780-4f1e-83b4-badd84eef307", "value": 3505221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033300, "uuid": "a6144bf4-4804-483a-ad96-0e88e77b4314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033300, "uuid": "b8839924-8c6d-44f5-a6b1-5bc48be4f7ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa0c405-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050135, "uuid": "07016ffc-f333-45db-9f99-2ac29e2f8dff", "comment": "Malware payload (Mirai)", "value": "fd2e73d57dfdf0f6e279fd60a13b09f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050135, "uuid": "f3aa5912-4a9f-4457-8ef0-7fab971dfbab", "comment": "Malware payload (Mirai)", "value": "58cb7ab0fa824a66332e1f6489fecc95dfc1638a580b5f1076b70935274fb0d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050135, "uuid": "822db739-f951-4502-8ac8-dfa3167e887b", "comment": "Malware payload (Mirai)", "value": "be94c52abb547597a53683ba4aab8e31e6dde8a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050135, "uuid": "f68b4e21-b873-4221-88be-246f24eb8ad2", "comment": "Malware payload (Mirai)", "value": "e2b8e7d56c64d10118057040fb4eafaadcccb96248776ea583a9fe76e2854efccf18a081a4a9641f32c0fcd4a6a6e619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050135, "uuid": "cf3181a7-8c79-46ee-8811-383cbb7a33d8", "value": "T157C3F809EB610EFBE86FDC370ABD0B0525CC651712A87B7A7574D828F64A24B49F3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050135, "uuid": "c616bace-cebb-4baf-a6ce-6a1770abddd4", "value": "1536:ZuVukiJoTO8ePxR0hV3kmsewHm2a1un+pYwgFU5ZLE2l08qlO3YXHYdxRKDLRh:kVukiJoGR0YkSwgy5Gt2zIRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050135, "uuid": "44d9c4a2-3334-46a9-9791-e23c5d3606c3", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050135, "uuid": "14cec944-fdad-4b68-9dac-4ca28ad01539", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050135, "uuid": "6061f4bd-aa34-4bdb-869b-b8a6260d24c7", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973eea19-d25b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764995126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995126, "uuid": "ab0d8c7a-00ec-4551-aaea-2321ca2f3e47", "comment": "Malware payload (Mirai)", "value": "9932980d3f059828729b5b3e8d3ff41d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995126, "uuid": "4515e2b8-10f7-469c-9217-35a572d13d15", "comment": "Malware payload (Mirai)", "value": "5969670d9632e1e3b734623b7e929c2009a6440e74689f1efe095402c9fa469b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995126, "uuid": "6ec344a5-1e5c-49cb-b84b-13c4b4622a04", "comment": "Malware payload (Mirai)", "value": "9f5f96c0f15e9dc9517e9064baddf51f32ac3137", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995126, "uuid": "2adc1c68-5aaa-4875-8c17-53653e6757a3", "comment": "Malware payload (Mirai)", "value": "a46275967c05b2169fc7942d05eafad6aa35a39228e469bc2220d20caf7c14f0828df6e727e11f01fee3803c62ac525d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995126, "uuid": "330be820-d75e-4653-981a-441975028359", "value": "T142D32A06B30C0A47D2632EB03A3F67D093EFDAC121E4F641356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995126, "uuid": "b7342f6e-fa72-4ce8-98e8-56313fc73388", "value": "1536:cP0nwryWv+n/qZI7cST98z+xpnvTnNIkH5Afg57PMfgvAtI20jDWB/qHs0kBB/zU:ccWv+ZcG8z+x57np0gVPM9t9BBben", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764995126, "uuid": "b7dda763-049c-45c8-a54e-845e8f9e565c", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764995126, "uuid": "65e56b5b-05bb-4853-b946-b1d0ac71cb62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995126, "uuid": "4af39b1a-4cfa-487a-b144-c96367aecec4", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1775d50a-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042157, "uuid": "4b41af9a-c93b-4bfb-82af-3747cefc3094", "comment": "Malware payload", "value": "c8dfb2a86f68e633baa5bf469dab803e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042157, "uuid": "deac36a6-e516-4dd7-a82b-d05e28c2b09c", "comment": "Malware payload", "value": "5a3b7f08013bcb3d40e4f885167e3aeae3b84ee9c4ac207df0eb83cccd7ac7b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042157, "uuid": "dd6e9045-202c-4a1b-a342-3657bd252af2", "comment": "Malware payload", "value": "405744c30b42c2a439c76fa92b45832fc844c325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042157, "uuid": "3bb0d787-f763-43a4-b955-0f79eb3a3ac3", "comment": "Malware payload", "value": "a354ed443dbb38e27dfe08c20613ef0e9e7c6aee590279cbfab83bd6cd9e7612a30af496eeaaab091c00afcbd6221071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042157, "uuid": "53a3ebbb-53d9-4183-b55e-3a4774d4ca18", "value": "T12872F80233F44258F17FAB396DB201684972FD7A9D31EA4C1CD9506E0E62B849F50FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042157, "uuid": "21f0ca8f-6026-40c7-b27b-617e7fd6bf94", "value": "384:gaM8+lCO/5vgQrMb+IZl9tZw9QOlg9cI3STt9fqKykOnL:tMtnpo9cQi2KyPnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042157, "uuid": "113f8037-021f-4738-9992-aa6c39ed1d91", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042157, "uuid": "63553aca-daa7-489a-9aae-c871ed148142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042157, "uuid": "c56cea62-7e5a-4217-a086-51a2a414ab1e", "value": "agent_fw_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd79b3b-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042273, "uuid": "f34a8f2c-45c4-44df-ad49-d0df74ffa3bc", "comment": "Malware payload (RustyStealer)", "value": "7efc715c8d4922ab8d794ac8842107d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042273, "uuid": "fa22cda4-7927-481d-bba3-02eb407ff4c4", "comment": "Malware payload (RustyStealer)", "value": "5a53149122b6699f13cd897970f1c266ae7fd10fa624e37c41620cec6dbcfac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042273, "uuid": "a76a1e44-6ac6-47c0-8305-1dd41ac4b9d9", "comment": "Malware payload (RustyStealer)", "value": "9176cdd7d1e669553ce291e5ac7707b7e07113e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042273, "uuid": "3c47f5f7-e246-42da-b15a-02708a45eb81", "comment": "Malware payload (RustyStealer)", "value": "a2d73a1143da3618891c6576e7b77d44fbdab517d288265dd5d25d3139fdc80b0057367fb8a837780bf960995a01f08e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042273, "uuid": "e9b30594-dff4-438b-9404-2b66af20be91", "value": "T1CB857D07F2A591EDC0AEC1B483479A33BA36B8890620B9BF17D15B703E66F515F1E709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042273, "uuid": "142f1571-998c-4152-996a-2b8bc015583c", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042273, "uuid": "082bca5b-e695-4df1-b3b3-8589f4abbaf4", "value": "24576:kMUTCv1kLdbXJJVYyvvTGSyCbMLm917ehZpMaVni6tQC83t/Lg:kMuCv8VYyvvTGSyCAg8ZpMa86tQC83t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042273, "uuid": "1761f871-d349-4830-8675-b473a716aaa1", "value": 1705472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042273, "uuid": "207d555e-8ae9-43c0-a19a-ea4085153500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042273, "uuid": "d53bee7b-56b2-4628-a614-c46e6190544a", "value": "test_enc_fixed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb26061-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038651, "uuid": "51ae6a09-d57b-47fa-ab1d-78812d37b838", "comment": "Malware payload (Mirai)", "value": "a65016bd837e623039fa1da82b9eb326", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038651, "uuid": "73dd1235-94c4-4d75-931b-d847caee2974", "comment": "Malware payload (Mirai)", "value": "5abd1ec94232a72c874d418bf28b8cc8d600c65d3c65ba84f9fa38c7a5d31d3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038651, "uuid": "d3634bfd-f562-459c-8d98-b7f70689a335", "comment": "Malware payload (Mirai)", "value": "b2d0b7545c61c21d9d7c4d653e91b990332d55db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038651, "uuid": "d90d1d95-324e-406b-b838-6c1d066204a7", "comment": "Malware payload (Mirai)", "value": "560ae83db43a70aea95268d4bdb2db8ab04b223ac6cb8985f97140828d255adab9076b9df0c692f3cb7935e4375ea733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038651, "uuid": "ce7f5dfa-7d2d-4d6e-8591-b432f24b4daf", "value": "T1D983AFB6E5142CA1CC422EBCB4F4C97903236C75016A2CB2AFDDDD9504ABB6CF54E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038651, "uuid": "861fd397-498d-4db2-b27c-07ca16f58680", "value": "1536:enlrwSofDFbIblNXfuUdnl2IEBnlu/Hk9oqd/yDTZr:enlE3pUJNXfu0JHfk9+DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038651, "uuid": "1d017d10-5ca3-4f37-90b7-c72de0d1b958", "value": 82652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038651, "uuid": "c8be2415-737a-4ace-b3fd-0e2cfde9e81f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038651, "uuid": "7c35efd5-36cd-4e3c-bd05-ab63ab4cc1a9", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2edefb9-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011923, "uuid": "ad6036a9-930b-461a-9891-a36b8d94dc0d", "comment": "Malware payload (Mirai)", "value": "5ed27f0aebb9e7a91d1941278757b110", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011923, "uuid": "36858667-b295-4c04-8a86-eb621ad5cdd0", "comment": "Malware payload (Mirai)", "value": "5b93f2ad8acbe8136bab7713d2462e5925fbd2ff28fdcad8813f1363513ac9c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011923, "uuid": "a63ed630-47d2-43d1-b592-cec858d48351", "comment": "Malware payload (Mirai)", "value": "554a1c62ca6ea4659a975287beb71a4ddd2bcad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011923, "uuid": "f82db281-8dd1-4147-87c3-2261a0c118bb", "comment": "Malware payload (Mirai)", "value": "f1360e52d611a8ca3a4ddec145558e4593e8e8343ecdb63d18a73ed502bdc12339c06f211176805d15dd1e9b4fb7bbc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011923, "uuid": "fe0a5927-e7b4-4ebf-b707-0a684a45de3b", "value": "T14B234B32B9392E17C0D4F87E61F34728B2F5169E25A8CA9E7D720E4EFF14A4065436B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011923, "uuid": "c9c0c355-671b-4a06-9505-a42a16ad906d", "value": "768:q1oWnwPFq9gDukXO10NNc01Hg3QadZo7O+F:q1JnwPFSgakXO1aNf1Hvw4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011923, "uuid": "2f268a97-578e-409c-9f73-d8f07f33bcc5", "value": 46068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011923, "uuid": "ec40a733-46ad-4f70-b4cb-4aaae756eb2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011923, "uuid": "14c92ff4-7749-4b51-8684-d6e34d63787c", "value": "hoho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b238f86b-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011922, "uuid": "56f18c2d-0725-455c-9541-f16c44d5b943", "comment": "Malware payload (Mirai)", "value": "ce8fa5ad0add1c8c4d230fe5af6e4090", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011922, "uuid": "baf8c65a-af21-4bd8-bfa6-eab330313d0f", "comment": "Malware payload (Mirai)", "value": "5c2db7f19bedad5f3db6b281062eb0460939b65b6d0d7445a3dd830e93be38a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011922, "uuid": "ea59cd33-3193-4209-a54c-d31dab08e718", "comment": "Malware payload (Mirai)", "value": "5fb98bf62e33b253178473af5f535f17f35c31f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011922, "uuid": "f233244e-f00b-4d81-9ce0-4f67b6936cd5", "comment": "Malware payload (Mirai)", "value": "1b49ae764f86b23d551f6726038a87455295e5d43958b696757b3d2a6dbd5b939373f18f80d7cab8cfd697ec27ff8d43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011922, "uuid": "edd32f0c-b398-4c69-bde6-dfb2f24c482b", "value": "T1AF038DB7C82AAD88E1484674E9755E781B53E001D3571FFA1A4BC5A58047EACFB0E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011922, "uuid": "329851f2-da59-4bc3-8b0c-100366fb78bf", "value": "768:Jaycvwt9KsLsaQdaeInyUDN1x/qmC3KonyMCL:JaNvwtsKLJ1x/qmWyMCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011922, "uuid": "64095eba-0ae1-446e-9a54-25dd0256e02b", "value": 38356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011922, "uuid": "2dcdd116-d26a-464c-a450-69bafe403049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011922, "uuid": "ee359541-fefd-45cc-b6df-2e874aa7ee1a", "value": "hoho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdba012f-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050167, "uuid": "89312988-e13f-47ca-81b4-ba96673ab0ac", "comment": "Malware payload (Mirai)", "value": "0c779d3409e533c119ef591d78b09bb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050167, "uuid": "6f69e2da-9671-4624-bc47-55f8b989568d", "comment": "Malware payload (Mirai)", "value": "5c3a3c4729538b9e4fd9d15f789058a0e90a8742ebdc0f819fab6322e3aba7c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050167, "uuid": "e83940d2-c935-435c-aa49-c8a4c4dd9d6d", "comment": "Malware payload (Mirai)", "value": "f4a87af3ac5a161b7da7e43437da992499de7121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050167, "uuid": "e3eec69d-3fcf-48f8-b427-84be0f2c6d94", "comment": "Malware payload (Mirai)", "value": "2c9f42d63d57ee270a966b1e1a8a6ed45d2d6621c513af009cf100dafd44f588ceeb008669cae4fcf5ff5f0df954a09a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050167, "uuid": "8ef26ad4-e974-4167-9e74-0420348ce92d", "value": "T1AF934A95FD818612C6C112B7FB6E428D372313A8E2EE32439D255F2173CB92B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050167, "uuid": "7fafd9b5-cd67-459b-9028-3b61043e06b3", "value": "1536:D4UjcWcuurmzETcbPC8GNW2yqt8JfPxXCsdRKW997pvY8z:D4UIYurm68GNyqt8Jf0S0gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050167, "uuid": "45dabd6e-dd62-405c-9c95-5e241bd1125c", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050167, "uuid": "4b470e14-b606-455e-b2f9-b75def5b3872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050167, "uuid": "a063e40c-5880-4d99-b977-2a2f4b7d26bd", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79918713-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049193, "uuid": "6b471a0f-fbae-4ad4-9201-80ea4b850d58", "comment": "Malware payload (Mirai)", "value": "58841297fa41b1a5a82dd3b5a3c9fb6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049193, "uuid": "6d187f62-3a27-4d16-b136-f35fe4768643", "comment": "Malware payload (Mirai)", "value": "5e107abdecbe1841e09e984378c2af3a25dcdfd1247f21462e155346fa13f2a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049193, "uuid": "607787f6-029d-4052-acc3-7e397000a2bf", "comment": "Malware payload (Mirai)", "value": "237e55379664663fb424f1e57d577eb80c0ea753", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049193, "uuid": "e7dd5909-3dc2-4ccf-aede-1f4d356e94aa", "comment": "Malware payload (Mirai)", "value": "fa1f1420b6412a40eb5c81a66da6d6f9cf4450777ed6afbe399dbc06d4f76b360a6e54b3943f7c2f12f8a0c89a03eaad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049193, "uuid": "993e131a-6e7d-4c11-b06f-0d5573dd8bc2", "value": "T133E45BC5E6D3C0F1E96704F0089FDFEB4A34A3220147DAE7E5881966B860F925B5B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049193, "uuid": "ed27dae7-0eee-4c79-8fbb-033526b834ed", "value": "12288:KaeqyfhYLhACktYQixbXUYyoTJmK78taSxb/EmeePhPyg7Ee3Lu:KaeHhYLh7khixbXUYLJx8taMb/EmeeVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049193, "uuid": "f3f5c101-51df-43b3-81a7-48164fe2423c", "value": 701304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049193, "uuid": "d7b099dc-053c-42c2-94e7-5ff1bd2e1433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049193, "uuid": "709f7b57-c63a-4391-8b70-f4cc6483070b", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1499bf-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042139, "uuid": "dd843d71-4a67-4e87-ba8c-d5c97652ecd7", "comment": "Malware payload", "value": "4d0875c9005d84159b6ba0d2e7fd994a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042139, "uuid": "3ac9d841-46cc-4e74-855c-54249bc069e8", "comment": "Malware payload", "value": "5e46b08b08cf4a2722459f48f9ef18f63d2c824bfa6798e254dac4f99b1eec49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042139, "uuid": "7ce7255b-e48a-4127-ae9b-3223758e76ea", "comment": "Malware payload", "value": "c03adc191ea0ce7af1c8e9b67a54188c848e5354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042139, "uuid": "db7ca6a5-5705-4da1-af44-0d55a0d53624", "comment": "Malware payload", "value": "895ef6612b8998832ddf6748156bd72a6c9d6b86a43447e3a32834077e539c81db38d270d44da9d40307ec8303270242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042139, "uuid": "76455288-6406-4afa-9157-03080ffde67f", "value": "T1FC721A0833D84614E1BF4B7D59F2022449B6F96A9935EE4C2CCD216E1EF3784DA20FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042139, "uuid": "786caa43-591a-4bec-a79d-1cbcb9bbb35c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042139, "uuid": "549ec39a-cf78-4519-9a3a-f43d4fe78e51", "value": "384:CP4lTO7H/GFfaXh2UlsUldFYC5R9VZw9q/x3WqVGNhj:CP4lq7+1AwUleCT97lVyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042139, "uuid": "94967615-be0f-43e6-9595-e60ad49bfd5b", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042139, "uuid": "54eebe77-3821-4644-aefd-6100e609b9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042139, "uuid": "e5bd0da8-e60f-4d71-81a2-402ad9ec4cf9", "value": "agent_anycpu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b45801-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050064, "uuid": "1675c9e5-2bfb-49c4-af51-9847a6ec8f16", "comment": "Malware payload (Mirai)", "value": "aa9c17d76b23b9340ac38eb02658a1a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050064, "uuid": "0eca8213-85b6-45bc-8a82-3282391b12a6", "comment": "Malware payload (Mirai)", "value": "5ebb09d547d7e3aea322d74216815a0a32cb3e3b7e53b77fb558c31f0f020667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050064, "uuid": "3c69befd-d813-4cd6-a9ad-1cc6dc5a6a3b", "comment": "Malware payload (Mirai)", "value": "71e8588e61b2dff52a516fec3dd4bbe6ffc50baa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050064, "uuid": "29a06946-2880-4ceb-b37e-ff6313ef78a2", "comment": "Malware payload (Mirai)", "value": "c7ecb73bacf593a202912bc5bb5d602a588e4836659f5934e70ea3a9ac78a0671b80f44aa945319180050e2541c742f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050064, "uuid": "68d03e37-a9fa-4423-a610-a37859cba16b", "value": "T11813F1760C42B0FEDD3EE07882F70F9068090B6E35836D562497DE9B1E954E5F883AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050064, "uuid": "730af1bb-dc8d-4a20-8229-0d983af77127", "value": "768:RUjKrZsAW6EpKKReuzSrQ/w6cPCPUyaBqf2V/hrLPtlUJgGlzDpbuR1Jk:RHZsAkpKKMTQC/x6W/BLPkVJuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050064, "uuid": "854e3db6-e797-4178-96f9-28e8072c76be", "value": 43188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050064, "uuid": "9fce95b0-852f-49b8-ae99-ab0042af8cb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050064, "uuid": "6c669f0b-63bd-477c-91d6-7555655668d4", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eb4b6e-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033838, "uuid": "afe97f98-d191-4b49-83e4-94a76b6e90bb", "comment": "Malware payload (Mirai)", "value": "926a10576c7b154f18d337b92fab6e25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033838, "uuid": "62c21a1c-0907-459e-a432-3e5f7d64f23b", "comment": "Malware payload (Mirai)", "value": "5ebd09a25fda4dcd3d4079d327a9e8a19dae3951abe59bb8e845b838981b0fb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033838, "uuid": "bc213459-3b42-4b36-a98b-339038e9b712", "comment": "Malware payload (Mirai)", "value": "3efe24e55f8f3a029d3bb3b8bca84e02ccd8f87e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033838, "uuid": "ac89fef1-60d0-47b5-9350-cf29e9dd2c07", "comment": "Malware payload (Mirai)", "value": "6d69158702e5ff24eeca7764430904ad04d6bb51808e8dbd806f8cac6f75783b37ec44942ee3b3a6143c5d40a24c840f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033838, "uuid": "594624f7-b86f-46a1-82fe-f9ce5a77080c", "value": "T1B3B2D0ED41005DECC97BD53C4B9403B13DA90E376422AD2ED682FE0DFE855962C8A9F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033838, "uuid": "42183a36-5486-4ed0-9041-58967f7dc80f", "value": "384:Wb34k2kJrd/aTsR2aj1IaTGC0OfEqZMQqU2oXzQjjVUZyO/MfXdpA0JgGlzDpH7G:234yuT/7aTGqMQrjsj4xIda0JgGlzDpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033838, "uuid": "b1a7ee05-b54c-4850-ae3e-5e02f1bc94b0", "value": 24048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033838, "uuid": "2f3913dd-5043-4912-b4da-18997cc47070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033838, "uuid": "fb6acdb1-8cfe-4a47-9020-22b9aeac8b41", "value": "b3astmode.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5568ff93-d27a-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765008330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765008330, "uuid": "b7fd26a9-8cee-4003-8fa1-7cba10ac86a8", "comment": "Malware payload (QuasarRAT)", "value": "862fa5d536b16d9cc32c7eaca24d59b8", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765008330, "uuid": "ff3de409-fcc1-4488-9de2-e5c475f82723", "comment": "Malware payload (QuasarRAT)", "value": "5f07c5c4e0e7154e891a3639f76c658eb6488c33d7e551c3bdf655955acb4765", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765008330, "uuid": "a667a56f-ac71-4efc-8c9e-84989f389655", "comment": "Malware payload (QuasarRAT)", "value": "4179f0089215effe141619a28eebac119276b618", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765008330, "uuid": "e18844c0-c524-4b43-8b62-cdb0c13e02e1", "comment": "Malware payload (QuasarRAT)", "value": "847ecb44322f21437b4dfd154fb6d8c8656afe7ed5ccded6dc2641fca98f7c3aca949124e11909e3aaee83588902cb5a", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765008330, "uuid": "14de0c10-772f-4933-9d1c-6b716c23ba94", "value": "T137E5491477F85E22E1AAD373D5F0501767F0FC2AF3A3EB0B6191667A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765008330, "uuid": "e8f1aa4d-18bd-4c11-aeb7-3c6a09594d21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765008330, "uuid": "73381ab6-b34a-423e-afb6-eba4319ea0f5", "value": "49152:pveG42pda6D+/PjlLOlg6yQipVC7fIs2Zpsk/QLoGdU7ZTHHB72eh2NT:pv542pda6D+/PjlLOlZyQipVkfIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765008330, "uuid": "828482de-bb3f-491c-bcbf-3bde47e5c976", "value": 3266560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765008330, "uuid": "dbfca318-6fa0-4ab0-ba20-43b884a0f5f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765008330, "uuid": "cbbdfd92-5f0e-4912-92bd-ce0c693d458d", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020de832-d2f8-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1765062307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062307, "uuid": "85d75276-4501-453d-abfc-6a2c4eb1bef5", "comment": "Malware payload (CobaltStrike)", "value": "b31b882d97d4028414b2e4b880065a21", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062307, "uuid": "32eaa3f9-919c-43ed-a424-5d64ae30d4f3", "comment": "Malware payload (CobaltStrike)", "value": "5fc803d3a97caa8c482a4e69cdc513e72a2c8c8eac47329c481b1da792deab46", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062307, "uuid": "67f72b17-ee49-4c92-be03-609dd2adb4e8", "comment": "Malware payload (CobaltStrike)", "value": "615c1da38b827e33587a882f6c9fa12aebc613ce", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062307, "uuid": "93822736-c432-47bc-93ec-fda3884ae4ed", "comment": "Malware payload (CobaltStrike)", "value": "b2d06ac7ea7939a74369f58bcd73c3c62d7c9773f1e84c61fb66df1ddc10f80245a435a2ed2aac7ee011dc1231d9dad1", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062307, "uuid": "e168feef-cedb-412f-bedd-2753fc62980f", "value": "T1D292D93FE71368E9C506D57845FF3733DCB13DB385A6A31E1724D2B42E106A42EAAA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062307, "uuid": "639e7840-8204-4220-86d3-95e48a09f2a1", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062307, "uuid": "6a082e5a-89b4-4460-a969-2fb353b49ba7", "value": "192:wV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/29kjuWF8qa1Dojjgi:SqaCF31cix+Dc4zjXjPFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765062307, "uuid": "0992012f-c7f5-4f62-b1d3-0d970e3b707e", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765062307, "uuid": "4ade02b6-8874-417d-9742-b548c0471a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062307, "uuid": "a9061699-4928-463d-96ba-ed37c932587c", "value": "stagedx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8f0b49-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033897, "uuid": "44d5ac22-0b38-4f8a-ac82-2a5064ed1fa8", "comment": "Malware payload (Mirai)", "value": "6950ca18c011520515d31a7613b1a901", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033897, "uuid": "c5b57af3-ca6f-4603-adc2-615508a06dee", "comment": "Malware payload (Mirai)", "value": "5ffd5294158766ff81395dbd50403a1c47efab4ed5dc5fb5297d547784ea574d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033897, "uuid": "220f32c9-5efa-4383-bdfd-d730dd686690", "comment": "Malware payload (Mirai)", "value": "c71c9e30bec2aa531d7bf00a8b6f7a8f176743f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033897, "uuid": "c69c27a0-f0b7-4f56-a8a4-dfba1663ab64", "comment": "Malware payload (Mirai)", "value": "3f17a68d07b4d0eafdb6cd4c8ce9a11af65b7d07c53d85b6e0819cf8346fcffe4e83683f375c9d27b9009c491d23fba3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033897, "uuid": "199bc869-0e6b-4947-acf3-e219298d519b", "value": "T194530946BC818F05C9D41279FB6E128D3313177CF2EEB7138E14AF28678A92B0A3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033897, "uuid": "2de806e2-60f6-4fce-baab-faf26d5d8718", "value": "1536:MAnFhcrimaOkjNzeB9a10MpCP4dujryRgHGNkDa50TKJov+ue4+CiwWc6IKiK9Il:ErqlFa9VMpCP4dujryRgHGNkDa50TKJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033897, "uuid": "c91665c1-aaa0-4f7e-b6b0-528d2462b1f7", "value": 62812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033897, "uuid": "d72d2213-96b4-4ac7-80b2-3564c0be4738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033897, "uuid": "e1276066-f38e-47e4-9542-36ffbbfdd922", "value": "b3astmode.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b73cf47-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981631, "uuid": "37b8df78-9310-4d9d-9e57-48a53451e019", "comment": "Malware payload (Mirai)", "value": "04eeaa4f0e58b04bcc532f3dc0e411f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981631, "uuid": "2ac0e354-0c30-4f92-89f2-c6db2250ad60", "comment": "Malware payload (Mirai)", "value": "6088f6f27b1647c2dccd8861e112e484e82a91a86868376981635fded155dfe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981631, "uuid": "259675f0-e6e5-4fb5-a50d-b0f6322a6fe1", "comment": "Malware payload (Mirai)", "value": "b139db47ff1d345cff0dc8d6581aa3d5e05ef150", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981631, "uuid": "cf7def93-99d2-4f9c-a1a8-379df3575803", "comment": "Malware payload (Mirai)", "value": "7bb5e1f9ea926c3bf782ac1c5dd9d08f308035778239be994f3595bc8c147e594b29a0b47259c23e8bdad71606bbaf6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981631, "uuid": "cff51f5c-f8a7-4b3d-86c1-e55177ed4017", "value": "T131045E42DA818E13C4D6277AB6AF424A33329764D3DB730699287FF43F8675E0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981631, "uuid": "b6a9c35f-01b1-4544-8cac-261e2bb6ebf0", "value": "3072:uuXGVc07fPO181M+LaUZooxa/GXkPmICAykmj76rvRM/9Of9wHNFR:BGvGMLaUZooxa/skR2j76rZM/9OFwHNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981631, "uuid": "b27f4708-d2af-49b9-86f1-f1bd57cbc0d7", "value": 185490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981631, "uuid": "28e1c8f5-ee52-435a-88ae-7e14e523b1b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981631, "uuid": "48f41c44-543e-4029-8256-a51ab9868bd9", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed728ef-d2a2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765025795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765025795, "uuid": "32157c4e-0ead-4766-93a8-5806225f9521", "comment": "Malware payload", "value": "a6ccf957a449670000099126b70e3b12", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765025795, "uuid": "50328b13-da83-4c01-94c8-fc214f3d1158", "comment": "Malware payload", "value": "608f19d820f0e79a534724412b18fb3e1720a5361371fd91fc42d7f7fc398c10", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765025795, "uuid": "2c5722cb-eebc-4272-9528-d1c5e09eb94b", "comment": "Malware payload", "value": "77119ae4f21a6bc17eb37cd8a7b59d9076d90596", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765025795, "uuid": "7e500ee8-cca2-494c-9e19-bed14e64543e", "comment": "Malware payload", "value": "154835849173d54fdcdad6eaa07c86a662d50e66dbe1702044a36a84209804f1f43543e3a78c06e5ed106b3a3dcb0614", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765025795, "uuid": "af93bc24-414e-4637-b0c4-a495aaa49300", "value": "T1B1014C9CE5A8CF4109B9C586F1B04504C490D0C7E1F4ABC6F28E09237F60D5E355324D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765025795, "uuid": "9002c689-b9e0-436b-9bde-b78899edf7bf", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+kjg8G5ZhG+E6:FH8j/wWi2jzkg8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765025795, "uuid": "6dbbefff-09c7-4a58-a382-76963393a654", "value": 671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765025795, "uuid": "27861fd5-3395-402a-8021-3673957a1dc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765025795, "uuid": "ea85ff25-14ab-470e-a973-d3e7cccf1f16", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d871a584-d28d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765016711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016711, "uuid": "675a5203-8414-4090-bfdd-ea87f304d4d8", "comment": "Malware payload (XWorm)", "value": "a237bb17045419dcf739a6a297b35580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016711, "uuid": "fda20415-eceb-4216-a86f-6503fcfc86dd", "comment": "Malware payload (XWorm)", "value": "60eb8632c8149decb8593d328b6d3beb5ed5307a7b039662f12da1fb0b0e98a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016711, "uuid": "f2156ba6-70c7-437b-942d-8dfeb4829681", "comment": "Malware payload (XWorm)", "value": "cb9a12d4a6eeb72b83bce8b2cf16350e6a28a3d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016711, "uuid": "6a644f9e-a797-4609-8918-6b68d2dbb6a8", "comment": "Malware payload (XWorm)", "value": "5128cddb2380dbcbfdb5279dfaf9063e56073060fe1d79b37e5534f2e91f48473276351b5be7754761a87f7a29f0dcda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016711, "uuid": "6cb63493-fa17-4cff-be88-b883116a908b", "value": "T18676E891F99695A5C56FF138A590A221B6717C1A43303ED35FE81AB90C3ABC4273FF18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016711, "uuid": "5c803376-6498-4701-bc10-568529de2184", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016711, "uuid": "f8dbd579-38f9-4b77-bc90-0a53d67c7de3", "value": "49152:HA5Xqt3icgTP2+3WnSJsCKYXmBq3Mv7wp:MI3i33hXMlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765016711, "uuid": "30e35abd-de73-4d6e-8cbc-96b6a0b29b41", "value": 7312000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765016711, "uuid": "34b97ff1-45f8-4f07-9661-8f7f13976aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016711, "uuid": "eeaaeff9-9b33-442a-a9be-124529d3b782", "value": "requirements-doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f658ba2-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042197, "uuid": "d060a489-f49e-40e1-b5b3-bbd4465aa4c7", "comment": "Malware payload", "value": "32a3497e57604e1037f1ff9993a8fdaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042197, "uuid": "cabbb745-bd13-488a-ae54-edbaf66b82e2", "comment": "Malware payload", "value": "613d4d0f1612686742889e834ebc9ebff6ae021cf81a4c50f66369195ca01899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042197, "uuid": "29f97960-218b-4cc3-87dd-1945b863c616", "comment": "Malware payload", "value": "34d3c75e79633eb3bf47e751fb31274760aeae09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042197, "uuid": "f49a6e38-87b8-486f-920f-af1198116bec", "comment": "Malware payload", "value": "e893c83cfeb70ea852c1f3970acd9afcab955948fc9c2cfb28fa87a691277c8fcc7c9c3b41fc4939afd8a4f03265bd73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042197, "uuid": "11e19090-d048-4f1f-a7ff-a297cdcd5f2f", "value": "T1D3F58C43F68581EDE49EC174C71B8732BA32F48A062076AF26D497343E5AF915F0DB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042197, "uuid": "21b828d8-0b25-4343-a64b-9cf3659d0a7a", "value": "8f5dc2a6fb20707589d577ec3eb1982e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042197, "uuid": "1dd6b406-b82e-4ecb-9526-3be80762cb51", "value": "49152:xe3aj+20DSqBlXXcY992n7jZDCW4Xg3UD18aLIWxq9EvIT8kzBIU6islx:hGDzXgn7jZDCD8o0z2+slx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042197, "uuid": "88631fb6-1df7-47b7-9d1d-5499cb372456", "value": 3480576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042197, "uuid": "12b4ac98-3acb-4c94-bf6c-98d04e81e867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042197, "uuid": "715e2f12-4754-4fdc-93df-cd02ad2b08d4", "value": "enc_c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2195d563-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042174, "uuid": "52e9fb9c-572d-4235-aee8-c34843f6175f", "comment": "Malware payload (RustyStealer)", "value": "9e492a9e4906946c20ae061fa29e62e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042174, "uuid": "8490151d-8627-4219-a7f3-c103ab7f0e38", "comment": "Malware payload (RustyStealer)", "value": "62459f33fd9a933799857e537cb3fbfd41b32658cde2a5119cc5a819aecc53ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042174, "uuid": "850d9076-90cc-4f5c-b9a6-fe466a2b38ed", "comment": "Malware payload (RustyStealer)", "value": "4490d9be948dbb8bc0b58c551c28bfb182a54d8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042174, "uuid": "e67c9d5c-febb-4283-ae85-5ce8a5f09bcd", "comment": "Malware payload (RustyStealer)", "value": "15500dc0781ba2bdfda9947219aa2e56cc033164bd8d36cff3f76bbbfdf2d534e57c595f72fc2a8192b9d9fbbfd7182c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042174, "uuid": "fe4c37b1-adfa-4a80-a49f-f2cd951a1960", "value": "T15FA56D03F3A581A9C1DEC1B98705A775BD7BB88D096076BF0AD34A303E69E944F1E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042174, "uuid": "f1b23cea-7a44-43ec-acfa-1c940420ebca", "value": "5aff6c59906e71ba7f18f6b50812a6ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042174, "uuid": "c6b3359b-b560-4034-80e7-d2da0b80d304", "value": "49152:sGjP0ydCl6/xSe7J88HxzA+8kgMWRXO58Eg:sGjPrJ88H9Wlgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042174, "uuid": "73456901-3e9a-4c8b-b476-2d85f91becb6", "value": 2129408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042174, "uuid": "cf4f4eda-ad11-4727-a58c-7afb13ced84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042174, "uuid": "0d796552-92f6-443e-9ec3-fe40d7b74f3c", "value": "dec_fast.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4c94dc-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981633, "uuid": "d7576c1a-fdaf-4952-bcd8-ee97e1bc0b30", "comment": "Malware payload (Mirai)", "value": "6ec5660c76caa8f8139c743d3f5e27c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981633, "uuid": "013673f8-a32b-497b-b2fd-63a5d0dba138", "comment": "Malware payload (Mirai)", "value": "627cd434de5236a833761f19966008f8faf2108a8758a12755a9356c1becd5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981633, "uuid": "9c15e30a-7c5c-4f02-8899-bde8f366a0f2", "comment": "Malware payload (Mirai)", "value": "0a0fe75dc990668acace5698e9b2a1eb16cc383b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981633, "uuid": "88a618aa-2291-4e4d-8d4a-20b08657958f", "comment": "Malware payload (Mirai)", "value": "eec1c835779ee6410dc506fe349db677334fa740e85ae6ceb55887804d3bc8e6cdcb94a1053cbf18afd9f29e19f664e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981633, "uuid": "7febb88b-980b-4152-8c6e-07eb81b6f33d", "value": "T16D83AE67C8156F98C0444A74E1F29D7C1733E51482272EFA59CAC5AA9883EE8F60D3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981633, "uuid": "3b2db384-108f-49f3-9ff1-6d81600a11ab", "value": "1536:Na+Q1JNpAIoZOSxRpHUp9uihp36m/N6XNg4KNzKVH7QniIdBfCNnJT:N98npAIoZOSxRGZh96W442VaiIvIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981633, "uuid": "0bf7345a-0e99-4da2-8884-153d8cd7be98", "value": 87820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981633, "uuid": "aa271cab-2bec-4ad7-a6a4-4459792aa007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981633, "uuid": "9994dd7f-46a4-47f2-9c4d-9f3bdf374447", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b186888b-d247-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764986581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986581, "uuid": "c2043940-9e25-4ae8-b8ec-9f0de9b87a85", "comment": "Malware payload", "value": "6caed5cb0d10a97415f61cd5f53d8b76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986581, "uuid": "e6a51f9c-7456-4031-9e69-a6ac45744969", "comment": "Malware payload", "value": "62e9a01307bcf85cdaeecafd6efb5be72a622c43a10f06d6d6d3b566b072228d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986581, "uuid": "9e452919-b095-4d89-a695-7a02e3a3c9ca", "comment": "Malware payload", "value": "8907872767c587733bdaa7d91dab2f9cb75d21e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986581, "uuid": "9082f83f-f353-4f48-a9ec-d205d162dd4f", "comment": "Malware payload", "value": "569fe158c62980a7e2577254fe4e0250e69f73fc54e27290091f4de1ffc44cfb9c2f1d10bfe3d509cac90e9a1b8f525e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986581, "uuid": "6873a383-8da0-4c6d-a97a-b71af7cdd305", "value": "T1FE123047A2D0CE3FC8E957384467122472B794BEDF629723064815B53F427E81E6EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986581, "uuid": "e3f2e673-e0ff-4a77-ae10-8fb40a76c8aa", "value": "96:GqTVJWWGXzS6hH5ML09V1J9G8YmZ+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHeZMWT1YmkhrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764986581, "uuid": "ab46c207-e1d0-4aac-a221-2da9328754dc", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764986581, "uuid": "bb371210-d3d5-46d7-9803-129cd3dd6813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986581, "uuid": "c17a7cc6-5b93-4675-8f6b-a19045d40a52", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8614c72-d2e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765054023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054023, "uuid": "ec455a40-1ad6-4c7d-8c37-047729056e36", "comment": "Malware payload (Vidar)", "value": "4126eb8f77e5713f1a992994ae940501", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054023, "uuid": "3ca01feb-4d64-42d4-b67c-786fb683b770", "comment": "Malware payload (Vidar)", "value": "630474ad3dd825a057b34e19fe99d9a80fe0f7963a9f6ad326c0ee3346295ead", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054023, "uuid": "3b23ad92-e4ed-46e6-ab4f-384be1caf445", "comment": "Malware payload (Vidar)", "value": "9aca879747272a07518da084a1153a77e5f1ce4b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054023, "uuid": "a08379f0-e209-4e50-899f-d871ed0c692b", "comment": "Malware payload (Vidar)", "value": "3194e1a158bc3675587c4fea8d7518a7de8d5c4a283cd5ba3d0a6f8c12a90256da07f93312984b27a955fbf29e1aa613", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054023, "uuid": "72eb2702-81bb-4679-a3d3-b4c1fa39333b", "value": "T1D6C423C643FD432CCA3050F88EAD64BD9FB35EBC6F6E8A9CCE449855AD44698DD88740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054023, "uuid": "8bde7889-a464-4099-a59b-e1780738490c", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054023, "uuid": "0c9c2794-86db-4029-a24d-b210c1ef186c", "value": "12288:6sjqhzpR2uASiVldtI76wRNhdenb79s0AHSDPt+:djqhzvpcPtoLwb73lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765054023, "uuid": "0475651b-37a4-4c8f-8d46-5a8c9bf9db88", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765054023, "uuid": "c95dda85-591e-4db0-8a08-1165643dec23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054023, "uuid": "60668985-b5e5-4075-8175-d7be5c0e7839", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89926b7f-d2a0-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1765024739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024739, "uuid": "20ac0b03-bf81-4708-b884-bc67b4b5917a", "comment": "Malware payload (GoProxy)", "value": "fd211a872c1ca006a232cc99560c7190", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024739, "uuid": "b901c0d1-0cc5-46f1-b12f-61743161f79e", "comment": "Malware payload (GoProxy)", "value": "63688e714a84f7953ab4e77cca7c798e8bfe6f8b97bac643df7a8ac85eb96f91", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024739, "uuid": "b3ff0ddc-2123-4849-9ea0-9a1878d0f5fd", "comment": "Malware payload (GoProxy)", "value": "9430afa30edba77b1b91eda29e4b8502762b6a15", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765024739, "uuid": "6c504693-f6b6-4871-ad8e-e529b9cec62f", "comment": "Malware payload (GoProxy)", "value": "aaae68fab5b02f9c9088ebbf9bdf809f689547dd38593af1e42b61aeabacb6acd77939abc6af626a3413df8fb709223a", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024739, "uuid": "977454c7-8fbd-4217-bf8c-fe36c199eb38", "value": "T106664B07ECA155E9C0B9D2318A639262BB71BC485F3123D32B90F7292F76BD06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024739, "uuid": "f73e12ad-e00d-4c6e-9e3f-7e11cad9a9eb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024739, "uuid": "9d220345-7f61-4376-a48e-3db060dd51c9", "value": "49152:wj9IjfzpkGYwgFWxDe/9OVn3mZ/+281AtD9zea7kyAb7zgQq0WvztjMefEK945WI:wWBkxpM082ttea7j2sX3aJbuiE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765024739, "uuid": "7180a3d2-6881-4995-b675-2e05f23400eb", "value": 6619712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765024739, "uuid": "2e2d9704-2e1f-4f21-8e19-53f55041c0d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765024739, "uuid": "ef674f04-71ad-42fd-9fef-343bf69efb7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e4b21a-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042240, "uuid": "b0fc0fc3-8f8d-43ea-8216-d3ee5ef66188", "comment": "Malware payload", "value": "b206e76f00fc04663e157eedca822114", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042240, "uuid": "31e76ebf-1abf-4160-80c6-456d7337560e", "comment": "Malware payload", "value": "63750abb5c17273ee28f64680c64f94451907c4b874a433b30401cb6d7f78b8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042240, "uuid": "05ca70f7-3aa1-4561-8d04-439911df36ed", "comment": "Malware payload", "value": "b27f567ff6beb994b0a48b54c3c9e255ee17601e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042240, "uuid": "58215c42-65bb-4e0f-bea5-15cee2f0b5ea", "comment": "Malware payload", "value": "5d103447bac93abe193633471685144ea89e285a804f4b90787182f2c540c1e6b65b4c53f1c995471d643c99b30f56f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042240, "uuid": "3a577b82-196c-47c2-9552-27bfd8e51373", "value": "T1F5A47C06B6A45668D15BC074835796B2BF31B8A92720AFBF03D095382F97FE11F6870D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042240, "uuid": "b8735f84-7169-4283-ae22-6f447ca7786c", "value": "2e5abbd6535772b65d48d6e66b39c856", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042240, "uuid": "e07e460c-1385-44a0-b2ce-3b437b2d2859", "value": "6144:FmV1bgCGHH5+B2VzbGR+12c01SfxWEVtiKwOnnkYgdgpSzGvrA:UuEw2cYOxxVBnkdKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042240, "uuid": "0ccf9298-2f27-47a4-8493-cb74a8261802", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042240, "uuid": "358e22c0-ccc4-41c8-97de-e0bab78dc503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042240, "uuid": "4726faf5-4131-4b49-8d44-83fdb146e937", "value": "nethost_uac.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63aa66ac-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (LockBit)", "timestamp": 1765042285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042285, "uuid": "eca33e1b-a24c-4162-932c-b4f742aec5f2", "comment": "Malware payload (LockBit)", "value": "c747d254c6d42c00e4150288a6198a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042285, "uuid": "85d193bf-73de-4810-8340-ede84bded2e7", "comment": "Malware payload (LockBit)", "value": "637be4d4df565ad9299be22e19deacaa343f05d56fb9ea0a201fb012ac8f4df9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042285, "uuid": "f40838b2-e5f3-406c-baaf-dc8bdd265a33", "comment": "Malware payload (LockBit)", "value": "ed69c7493d53fb91758d5c0145e0e35abc2ab3fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042285, "uuid": "70052c75-ab76-4dab-8b44-c78cc6b1c6ae", "comment": "Malware payload (LockBit)", "value": "ea59237f779c89214e0687de9d1806f2b7c15b2489dda12ee17977372ea27e7350bb6f9bffb93d9a5773d926c15a14b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042285, "uuid": "dec60cdc-67cc-4d14-a932-0f4fea2d9b52", "value": "T118E312A341075D79DB89297BCE5C263C962D6E806E50F5E578A8F803DCF38FFA900459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042285, "uuid": "17f33857-0d08-42a6-a94d-502b10ac9fee", "value": "3bc510de773c954bd69d33670cb624d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042285, "uuid": "9ab18714-2eef-4d89-a820-3b5ca6d6c9bc", "value": "3072:mY+xaCkDC5Gvuy7rEMdZy6BTJ1GqiTLR6EiWuOlUnUKZaV:mJqC5lyfdZy6ZGzVUn/aV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042285, "uuid": "6fee7219-9b9c-418c-8a07-f9a7749e83e2", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042285, "uuid": "8cc3cac6-1335-4c80-aaea-76d9ec1db5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042285, "uuid": "d64d35f7-e0d1-4b4e-a7e8-addabba78213", "value": "test_pass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3e57f2-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006119, "uuid": "712d828b-e85a-409a-bda3-d1c836bca3a9", "comment": "Malware payload (Mirai)", "value": "be3579e1972e14ef7b6252b8e7dc1438", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006119, "uuid": "d8adac7b-9f68-45fd-bb9d-5e25fc0b85fb", "comment": "Malware payload (Mirai)", "value": "640575696cc669dffd0cd6e9de134258812778ce40d81fc3a75601f48e885aca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006119, "uuid": "f89d0ed2-f291-464d-a9e2-97665cd1b381", "comment": "Malware payload (Mirai)", "value": "ce02ba9cbe8aafdae3c27914b037c14868857dc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006119, "uuid": "4e80d9d8-0b62-47d3-84f0-aff1bef1a16b", "comment": "Malware payload (Mirai)", "value": "69548566073f4273f52ae7c93fd60cb310e08b92b9852157b9749d5d1ef01e7a3da05fd5740409f4c8b2d5cc1622a6ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006119, "uuid": "59b5ad5c-f0f9-4f4d-91c1-a37e4aff5cc5", "value": "T1D83131C1B3E11D6CD4E051BE8C4B0F18F3399F80D2E37123920C3328AD2AE785E2A465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006119, "uuid": "28f6c03d-d186-4eb2-b605-263f5ab9b670", "value": "48:mcJKGJZ2oNi/YqCpFaFaX8o3ABubLAS4:mcJKQ2KFaFWfAlS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006119, "uuid": "709d9c4b-085e-4080-bae7-3a07504ff74f", "value": 1624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006119, "uuid": "3679975a-6d93-49fa-99ba-d1675278af50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006119, "uuid": "5d1cffe9-ea28-482c-891c-ffa9585cabb3", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3786fc80-d25f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764996684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996684, "uuid": "dfd4bc0f-43a0-4e6b-b1d3-9ec364791c80", "comment": "Malware payload (Mirai)", "value": "05fd8a40ab55a666470c70c2469bceef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996684, "uuid": "0bfee012-be97-4b2e-8195-5f7f6fb56888", "comment": "Malware payload (Mirai)", "value": "640b1b5ba4c58f149d995010a81d6970f6239cf1d9e8fb0a27901b14e89e2807", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996684, "uuid": "941cb5ba-05ca-4086-bd0b-b1281dc464d7", "comment": "Malware payload (Mirai)", "value": "d5d41d3eb886a87c1e050009e24e042b1fa95de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996684, "uuid": "98cd4a15-d8d6-4832-bb11-9e49d13556eb", "comment": "Malware payload (Mirai)", "value": "42bb497208c7d1386d535d016be71242ce42127b1fa62b8bdd7f400866b1d980b3b99d6972e2a1ee79ad0afcc18f7639", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996684, "uuid": "a1190d4c-5cc1-44bd-bab3-a0db86be5078", "value": "T1A7140905F9144F67C2C22BBBF78E429D37366B5897D73302AA386EB42F8679C5D29110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996684, "uuid": "f5188e65-19c2-4f00-9a44-ecf894733a33", "value": "3072:zqOn981e4FhRT3LPo0lXSUMyBeWLl7mxGX3icZ7Tv4o+MQCYl:eOae4FL3LPoAiUMyzmxGX3icZ7Tv4o+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764996684, "uuid": "696dd868-ff75-4c23-b21b-079bfa4e927a", "value": 194858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764996684, "uuid": "eae3d023-7c30-4690-aebb-d1595ca47820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996684, "uuid": "fc517102-7e7e-4f08-a375-4644a54b3fd2", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626a77e8-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackMatter)", "timestamp": 1765042282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042282, "uuid": "c2aa9d20-ad9d-45fd-bc06-5d722c1d9d89", "comment": "Malware payload (BlackMatter)", "value": "c444ba318a9c50e4ac3b46e9ae2667f7", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042282, "uuid": "7d531e03-4322-4f75-8635-91d47d90e223", "comment": "Malware payload (BlackMatter)", "value": "64c924b671ac30fb16981fe3473e6241f41bb8ddd39d342d279f2c5ecba65fc2", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042282, "uuid": "608733af-a415-47e0-a97b-f350ba37fdf5", "comment": "Malware payload (BlackMatter)", "value": "15556d8d57fdd96369374aaf9352fedb9e91414e", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042282, "uuid": "fde97720-28a9-4c96-b3ca-3a627beda884", "comment": "Malware payload (BlackMatter)", "value": "1d78b0aa338d358bb9ae9ff635e96c0397b0f0da1050a289180ce41bd957c775825da2321dcf651d1c9f49d791644b2c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042282, "uuid": "25cd31c2-0860-45f1-b268-ab923e4912aa", "value": "T1BAF37D21B112D177CA5238F2A729B7B0738A5E2C12B8A467F6E4CF4B35738236F15947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042282, "uuid": "50cf5e3e-aac9-404e-b0f7-127153eb3666", "value": "3bc510de773c954bd69d33670cb624d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042282, "uuid": "b51e0aa2-4272-46c6-8903-1b43451babff", "value": "3072:VDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368h6QrWx+A0dOvAiTf0W:H5d/zugZqll3ljrd8vJTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042282, "uuid": "1cfdb787-db34-4820-b60d-1e6a91b41044", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042282, "uuid": "66769844-4695-4307-abb9-5338448e51ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042282, "uuid": "80bcb8e2-aae4-4421-b7cc-690cea090fc2", "value": "test_nopass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fc6427-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002397, "uuid": "7dfb9057-22a5-4f05-9fbd-762bf5bdd4f5", "comment": "Malware payload (Mirai)", "value": "857ed9e0a7978e7c89dab297f7d87377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002397, "uuid": "def2e801-cd85-4652-8e6c-8928adf5097c", "comment": "Malware payload (Mirai)", "value": "64e7d90377053cfe382d672c279d9b7b5df178102be49bed813d41155bbf36cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002397, "uuid": "bb1dd748-479a-436f-812b-1a43c633c9e4", "comment": "Malware payload (Mirai)", "value": "3826d70c19e3405696406a6875830e633a689028", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002397, "uuid": "d2f32c78-1689-47a3-98f6-712f13a03530", "comment": "Malware payload (Mirai)", "value": "0283aab1d3e76a45b7e05012ade16daaae9e00fe2ec8f3980ac95ade3b831cfd1805935403f4d35a481609eb5c943fbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002397, "uuid": "8a3ebaef-9aa8-4467-8d38-a73496095a07", "value": "T12EC36C44FB87E5F0DC4205B0102BEB32AA36A9366230DEE7F7E8BE736961B11541671D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002397, "uuid": "5a037e7f-ff86-4f6a-b41a-b0fe3f32c3bf", "value": "1536:5hfqSfpuN9ffdS79k1ZkJcbPrGw9FfnvlsFuSA8lFG/7zOmcG4zmoNO5lUm318A5:jDA9nd0k1CuPFfviFu843Om2e+3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002397, "uuid": "89a8c55a-307e-42e7-9e8e-c6b70a29bbd2", "value": 120488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002397, "uuid": "e6bbe66c-b9a2-44f5-b203-df8b4ebfd8b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002397, "uuid": "4afa008a-8d39-4a9a-b9e6-2a7879a282ce", "value": "colonna.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ba5e47-d297-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765020889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020889, "uuid": "39832510-94ea-4f97-81fc-93798d29ebe5", "comment": "Malware payload (Mirai)", "value": "186d736d27a431bba8fc2ed0ff51660f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020889, "uuid": "611293f4-2379-4741-a087-aa44a11c2444", "comment": "Malware payload (Mirai)", "value": "65f88bcdf622dc4d768771fb825af1fb3e2f566c9b6d0d3df4525db6bea00041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020889, "uuid": "adb23a1b-6282-4564-8944-9ec4bf6cdb29", "comment": "Malware payload (Mirai)", "value": "5fdd94d9e7f30688f126140f91626ebf8cff3795", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020889, "uuid": "6f1ff635-2cef-4fac-bc74-7cdb7f0cbf97", "comment": "Malware payload (Mirai)", "value": "23fca68bd46b2951e1c04efbd4d98900e3f992dd8acdeb9abcfeb435be3358cf1d3e343e8917ef11e459021711cc1a33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020889, "uuid": "b1350622-198c-4842-b23a-3757be7d44e2", "value": "T1BBD2E130855969BBE6704C78EEED3C4733A352B5C5E82922BA6401B8DCD3D2FE26C547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020889, "uuid": "7cec6226-21e3-47cd-97cc-033a62f9dd21", "value": "768:ifxapy+SzSSynle1UeZQP3Js90UH7FLqms3Uoz9yS:qB+SNme1UeC3C95H7FMzUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765020889, "uuid": "00a1ac6d-d2f6-4d6c-9389-e293e9b8b5ec", "value": 30384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765020889, "uuid": "6ddb24f6-9cb0-4819-aacb-88db668ab270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020889, "uuid": "46cb78aa-ae70-420e-8870-0daf99b255ca", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e745156-d2fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765063267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063267, "uuid": "d105a2eb-09de-49bd-9938-03502c2fa654", "comment": "Malware payload", "value": "2f83f063fa3766d18b52ab3c879fb1d7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063267, "uuid": "0c2d908e-94ab-42ac-b56f-7d49e327f740", "comment": "Malware payload", "value": "6780453ce4fb419f2876decae3b36602b89714b0e0136b30cc1f26633b9aa4c6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063267, "uuid": "2aa541d0-ab9a-49b6-81f4-e4a12cf97174", "comment": "Malware payload", "value": "7687298e7292b63efc31e13080ef4f0edfbf7dd8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063267, "uuid": "e269ae73-8332-41d3-a14f-6b6629bf254a", "comment": "Malware payload", "value": "a79909a41270c010c791cd6e15c79e2ca16d6981df15ced7deabc9d1ea1ffc2b0b1985793b67c9be757c1e8dba1cedf4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063267, "uuid": "ca815825-65f5-401c-af6e-9bbc0a99813a", "value": "T19A1395665804D638D43A0371435A0ECA8A679C4708B61D3E7BBD77D85FBBCDB93A18D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063267, "uuid": "dfb4d1f2-d8fb-48b7-b210-fb3f0a029747", "value": "768:qyWMDC+xrAGI333L4EZCX4HnzlGhQ1j9tTBIvq:q0D9xrAGC3sEZCX4HnuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765063267, "uuid": "981eb0dd-2ae4-4a43-b9c0-f815f839d770", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765063267, "uuid": "e7bf359b-ce70-4400-b56e-3b82bc408d4d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063267, "uuid": "382cd116-e594-4d32-912f-5715f3ef2077", "value": "g0gg1ns.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84efc362-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061238, "uuid": "e03d0ba3-aff8-45e0-8e36-c9517f8e32ac", "comment": "Malware payload (Mirai)", "value": "5ef3e4a9932257107b4164d081b71547", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061238, "uuid": "d852b861-746a-4b14-9d7e-92636929cf38", "comment": "Malware payload (Mirai)", "value": "69d66b7b4da4551db18503490147ebb357616cb24ff2237452512a15fb4236e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061238, "uuid": "821ecc17-30a4-4033-8ca6-baa7cebacbd4", "comment": "Malware payload (Mirai)", "value": "691407b78a4e8bf7f94caf81dcdddb427545920f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061238, "uuid": "0c8b0dbf-2d07-4b38-a64d-04ec7e047f69", "comment": "Malware payload (Mirai)", "value": "d067449e9d29caca57e750f3c3532b8269f4a5712a18b4fa573837b0a1cb75cad4c862a0a8e297a1fdf4e44feefac3ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061238, "uuid": "375f23b9-b3a9-4d0c-8759-5046e6b91721", "value": "T171732981B8815A13C6D112BBFB6E418D372653A8D2EF3207DD266F21378785B0E77256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061238, "uuid": "4c2aee9c-fb04-4b74-85fa-c32eb90ef77b", "value": "1536:H7kTmcnhv5dh8aQf+Ct8/OivnoanB3+TnKvKo:H7kBncf+gvAp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061238, "uuid": "5dcb5728-f4d6-4b38-8d2b-0332584daaea", "value": 75240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061238, "uuid": "4d8e25b6-f028-4913-8b9c-5b909a68bdc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061238, "uuid": "92f5abce-b04a-472f-9c81-7df86fd933e0", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb17240-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042142, "uuid": "1c026479-a998-4d14-a71c-ba20b5946f32", "comment": "Malware payload", "value": "83449ef17df96972294d28ab926a62eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042142, "uuid": "11c13f41-8fbe-40a8-9ba3-de7d1b93c3cf", "comment": "Malware payload", "value": "6a64761a83d244faaa25b559b575c01daa9cd63dc12903e62b42981da9a21d2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042142, "uuid": "c54b029b-08a8-4bcd-961d-2a97d5e76ef7", "comment": "Malware payload", "value": "cc15a5f12d55860fc7cd2028bdfdb6c532ab8d0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042142, "uuid": "0c3d2381-dd29-48b4-9baa-e2dfdd71fb81", "comment": "Malware payload", "value": "7293c63ac834394ecb3e4da886a4422eb5246a10c40184499aa0da4d9165619a0d65bf8415b444985c6181978da56225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042142, "uuid": "c0b710b8-f541-4857-ab73-8178024cdb92", "value": "T1DDC6CF56E2F900E8D5BBC0B8C6575517EBB1344917309BEB56A08A692F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042142, "uuid": "9deefef6-4c4d-4971-8847-c19472e6c0c5", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042142, "uuid": "928edcf4-d69c-4886-9641-148598264a35", "value": "196608:RKx5ZkerI1dc9irWBGFGJ+VYIjXEDfbVmin/adhaqMb6:RKxapWfk2IQDfE5haqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042142, "uuid": "5c5337cb-a609-4f57-9b96-6a8db70406dc", "value": 11651033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042142, "uuid": "4eda4a0b-2f3d-44e5-bbdc-142c93a63d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042142, "uuid": "f7640e5d-cda7-4587-8730-78a14e5cf847", "value": "agent_dotnet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613609a6-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042280, "uuid": "99f527d0-b511-4bb5-ad77-8d694e90077c", "comment": "Malware payload", "value": "48509d28dd1f192ae2144a3a4beb38d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042280, "uuid": "70a1014d-f5ce-4db4-9d13-c5bcb5afea50", "comment": "Malware payload", "value": "6b8e4dba8edc08d2c7ca7da3bd9851e2e00129281786735e724a84fd6f4042d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042280, "uuid": "a8458f32-b1e2-4006-8e53-174378927618", "comment": "Malware payload", "value": "4a8f0523da0072bb8bcdf50799adbc164f00f089", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042280, "uuid": "d91de924-bbe0-4054-8b5c-d8f57b92a9fb", "comment": "Malware payload", "value": "c3d6b042b2db2356b55962a51deb14571b9eedf88f5ea4a49717895ecc36a6a5a0e5238a015d32e9e799b6ede2af77d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042280, "uuid": "5a451e1b-36de-43e4-8e7d-bf6a07aba39e", "value": "T1BEA48D46F7A45668D05BC034D3579672AF35B8A92720ABBF03E082381E56FE61F3D709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042280, "uuid": "cee3e4d0-7902-4997-aa7c-22d57b51a5c1", "value": "54e71dd6ff09fd569a5edc86ee874acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042280, "uuid": "62b82fe1-055c-47f9-aec2-06d4bf95e641", "value": "6144:2jS1OXTkxNzJHZAPvMeKR+zqL7VD6ewVCY/n+rOcTCgdgpSzGvr79:2ehBCvlqL7VD6eC/nIOcT3Kn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042280, "uuid": "a59183da-417e-44e8-858e-363b9c53866d", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042280, "uuid": "358fd6e1-41e1-4a8c-b704-a2825a8e600e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042280, "uuid": "bc055dc1-04be-4908-88bc-0bc609634e8d", "value": "test_killer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5feefbb5-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042278, "uuid": "9afd4494-82dc-4c74-b4a0-8a74c2c0897a", "comment": "Malware payload", "value": "4ce7f0bda1f3606270e5f9677d526771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042278, "uuid": "6e7b9a60-985b-4d72-be92-6d1be64ad150", "comment": "Malware payload", "value": "6c21c70ae517ccf548ac326ac133337b8d12200658ffba5a1f2d7053a34aadc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042278, "uuid": "653f4943-b857-443b-a16e-d7d7ee8a38d2", "comment": "Malware payload", "value": "426a4740043780ff152ffd651a2abb7a8692f8e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042278, "uuid": "93b588c9-24bf-49ca-8322-94ac558b22c1", "comment": "Malware payload", "value": "72c52319a1f5629e330d7a304ea20f773dcd372794486e79916a1f3591c38a107db7b0f7a657100841a965b292b04bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042278, "uuid": "6ff18bcd-471d-4162-991a-26e957414a83", "value": "T124F6E8E85DC858A1D257F83975997EF411323197EADB1E90C3BCF9610D7EAB2AE0090C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042278, "uuid": "9cc89079-d4cc-454c-b00c-63ba9128eb7e", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042278, "uuid": "a3df0bc1-868f-4145-ab04-bc319f0ef9c4", "value": "49152:nqBPaCG6rjNYKMJGSy2GJeKrExv7i8KUUBS:nqBPtMJGSyGx4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042278, "uuid": "a2028ae2-d252-49fc-8094-4ba1cae23adc", "value": 15562240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042278, "uuid": "2d8b18b1-cae7-453c-a7f9-d0a317aaa486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042278, "uuid": "dd6a586f-36fc-41b0-87a6-9d9141f550e9", "value": "test_gui_enc_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709c1b10-d290-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765017825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017825, "uuid": "58259ae0-7577-4d78-ac73-288f81760142", "comment": "Malware payload (Formbook)", "value": "a522d1eeff1e29bd485a70042186ea9c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017825, "uuid": "3dafad5c-71d2-4d8c-8572-4d5a587f24ed", "comment": "Malware payload (Formbook)", "value": "6c7094211e2aee20d8765420c5568d13810f6c05327db21a044bb937272ac2b7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017825, "uuid": "f3a2ca22-7f26-44ea-9d11-4d7835caad80", "comment": "Malware payload (Formbook)", "value": "d31ddf1700e1ad6ab31195072330bbd1ddc5bc56", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017825, "uuid": "4db6dbba-5b8a-4ec8-b6c5-ed23bf2b495b", "comment": "Malware payload (Formbook)", "value": "10e52f85fbe084f18676f4b6f8488f48aa10a4502ab18f32fb68143fb4a80253e8792ff91f8a681b73851a6c812cca96", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017825, "uuid": "aa72a9dc-454b-4b9e-94ce-cf83551bebac", "value": "T1EFA5CF5D84B06CD26014FEB4F686FFD7CCEB5385162707520FE4858A6322C83FAA76A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017825, "uuid": "cef57a2c-fe28-4108-a99e-9ad2922cd601", "value": "12288:2Ufvrw6QWYpnTd/sfG/roBKPfgy/A+kvePrCzdActejWE8s4ebZmeo2Qx+v+miod:2UbVeKfmhGuruyOW4eDhzZ6V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017825, "uuid": "7768c640-1ae0-461b-a9db-1656d54f0b92", "value": 2112464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017825, "uuid": "1f2d3b06-9f1d-4d60-9e5a-7f34b9900449", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017825, "uuid": "0342fc5d-b07f-4f7e-9d10-d1054de92a33", "value": "Sample Specififactions.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d85826-d292-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765018711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018711, "uuid": "e72453e2-b826-40af-80b7-0afd062d03b5", "comment": "Malware payload", "value": "58327cd9fd65a25a455e00bfb088089c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018711, "uuid": "f256bae9-2580-4757-9fda-929ccb9904b3", "comment": "Malware payload", "value": "6c7abb649fe9feb1bcb756a9a3987c9d5540e6ed56e34c0e72873ba40dd15bff", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018711, "uuid": "711ab624-8425-4812-af10-5dd261b512fc", "comment": "Malware payload", "value": "c5c98e3874beb1e0a36da78c0ca7829beaafb9b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018711, "uuid": "6df79bdd-a4c8-472c-b3a4-4c6471c3f04f", "comment": "Malware payload", "value": "d743c793a42850b27e2cfed1d878859fa5c7aaee553c00a860613431d41e0027acffa6a089eec151a906fce3f2f8857b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018711, "uuid": "2d892629-32d3-4813-a342-e2820625be31", "value": "T16C82E15C84CB4521A0D677B6D78B7CF42D7795118D8DCEB81C98F4444F24056A70BFDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018711, "uuid": "bc40b300-a13b-4130-8a3b-ab86478b0e5e", "value": "384:WV1e6RZ2R9cldPooIsUF8G0UDn6yn8xFCS0YY+8BSO:WuwPoo9UF8G0UTWxkIYtSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765018711, "uuid": "58985981-fdc9-4012-b8c1-4b5b49f4cd65", "value": 18442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765018711, "uuid": "09a4b10e-7f49-46b5-bb42-704058087718", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018711, "uuid": "cf550ee2-3881-4857-b890-fc3a791615cd", "value": "800 5339.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f361e0-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043501, "uuid": "b2e49d8f-277d-4999-af12-1c29058dbfc1", "comment": "Malware payload (Mirai)", "value": "cd0d897ddab3c5d8e9c231e5767bfbcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043501, "uuid": "3e10a267-00dc-4289-9750-b8d1aa657d9f", "comment": "Malware payload (Mirai)", "value": "6ce90d06651405ce42e30a0b9573337663689d020925e85a0015460ac52b90da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043501, "uuid": "b0aba5d2-fadc-47a9-8e4f-6a8bef1c2269", "comment": "Malware payload (Mirai)", "value": "901611e67201edbc675eba2624c2503fe044b76c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043501, "uuid": "a2e56f60-c6f1-4c84-ad3d-0753a38aade7", "comment": "Malware payload (Mirai)", "value": "7adf5a39ddc23a189f1aefedb0ffa58f71c415fa8d785203dc1814bb7933681ee1466508cdbb0e2805ef01d7299dbfdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043501, "uuid": "c9535ad4-a047-4e7c-a0a7-c3a1c0360750", "value": "T16D730995B8818B22C9D512BEFA1E118E3313177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043501, "uuid": "69421f41-d678-479b-906c-9f591d0afb76", "value": "1536:TAnYSDACyTQ8bE80RbavEwpDQQMgiR33ATHa387oL5oYMd:mMCHYp0Rbavg3ATHa38kLyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043501, "uuid": "f891694a-48ee-4e27-899b-9d9df40e8997", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043501, "uuid": "7b132f6c-748f-49ad-8b33-e191cfb18664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043501, "uuid": "89d2b15d-9fce-46b3-9e04-5780b1391ac2", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3d5eab-d25d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764995886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995886, "uuid": "f4cb4342-9faf-481e-8cd8-8c5c5ce8cdfa", "comment": "Malware payload (Mirai)", "value": "8c6a9845eedd74f1158cbda5e811da47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995886, "uuid": "72a6e414-64cc-4e58-ba6b-18c081c2cec3", "comment": "Malware payload (Mirai)", "value": "6cea73b8c0fede36f6d0dc61d8416ebdce29ade0a358e9061fa88328f174f1e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995886, "uuid": "30f8ceb1-19a3-4c82-adac-a95f9751bc3f", "comment": "Malware payload (Mirai)", "value": "b1fca9af863a37788df4ddb875ac337ec98fcbb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995886, "uuid": "2a0659bb-1afc-4e2d-b1ea-4b48f1c6dee3", "comment": "Malware payload (Mirai)", "value": "8e952baedbfb40f4577011d7cea817d960300ead8db67a1ff85d6ea6080f4056c9fa1f99551877c21d059e8d48c1a1a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995886, "uuid": "177eb6d4-c485-4a49-97de-3d29eb7a425e", "value": "T1E004885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995886, "uuid": "c6261ab0-3045-41cf-b994-645813fa5f05", "value": "1536:Cl2JvnXPvLIQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/znt/Y:Cgv/GcwZsCK9VRhAX+bShFSP0HbbnlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764995886, "uuid": "bc8b4aea-0f9d-4066-91e4-59b81aa95006", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764995886, "uuid": "0663d701-6724-4710-910a-6fc865299fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995886, "uuid": "3e80b9a9-bbde-47ed-8680-c62063e1a8f0", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7154fe9e-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049179, "uuid": "9bb08000-9c1d-4c30-8a1c-9a04e4740814", "comment": "Malware payload (Mirai)", "value": "62ed3227e5a65428b3d66fec15953010", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049179, "uuid": "e74fd178-0c6d-4f37-9020-3b5154c3b29b", "comment": "Malware payload (Mirai)", "value": "6d7ce9013b1bf3ee2bd435541c3eb8a633ef1d694994bda82e2b1ff76a89a8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049179, "uuid": "808466b3-73b1-4a5d-b0af-d6be33fd896d", "comment": "Malware payload (Mirai)", "value": "13b20dd671cd1944e07c9868a2df1bdf7669663a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049179, "uuid": "b28d5e00-1b81-4a49-bd12-25b6aae559aa", "comment": "Malware payload (Mirai)", "value": "21c3c599709a7b4df184fec4674594e9db50a48db1bba1858717cfe8760affc33e4bd03c3942c61e8dc2c178b95dc276", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049179, "uuid": "d8383061-825e-49bb-af0c-dbd0aa57d9c9", "value": "T134A44A55F880DFA1C6C129B6F64D86AC33174B79D3EB720689255B343BA786B0F3B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049179, "uuid": "e4eec8ae-8dd2-4d48-abf2-8fb9d64bf168", "value": "6144:f843oncMqrCXi6CX7zUCj7lxFpvXWJO2BgyND5CFkQdvoPnoQMg7eHQgpjrV6E9:0cVrd7w67lhYtV5crBoPrxgpjrV6E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049179, "uuid": "5e22fc6f-5821-4118-9174-b296af7a5248", "value": 492584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049179, "uuid": "6f601975-b901-40f1-b2c1-fc51cf24e88c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049179, "uuid": "d93dbad3-0eee-4d58-a07b-fd8a681a3815", "value": "bot.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4798d1fe-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1765049968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049968, "uuid": "0c488e42-6328-4cfb-847a-37c3302dd7ca", "comment": "Malware payload (Socks5Systemz)", "value": "0f084cc55ae3ced5e521a915f8516a94", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049968, "uuid": "cc78b523-a307-4d3b-b5ed-d74873fd5657", "comment": "Malware payload (Socks5Systemz)", "value": "6da8d4dbd3f897261f0f42a3127badecd6344e98e12016cc1bf53d7ff8ed8a71", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049968, "uuid": "bec142f5-8ac9-4a03-8cef-3bc4c2e5b118", "comment": "Malware payload (Socks5Systemz)", "value": "b84275f2e52421039c60e636417c822804db7d7f", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049968, "uuid": "bddb52ae-3838-4cba-b225-5512c5860d40", "comment": "Malware payload (Socks5Systemz)", "value": "21d3fa84c96156ed5b816fcd114174c67a3702a443fa6505e6512ef12d1ea15109492199d6ebf59cb34641422d507e43", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049968, "uuid": "76894c1a-1882-485b-a60d-c8b358d60af9", "value": "T11D063367A4B68E36CAD256F08E1EB676807B36072E186349BEDDD4CE9CE7D5144E0330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049968, "uuid": "9cf27a03-5471-453f-a4e0-3f10f2348442", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049968, "uuid": "a68f2733-5212-428e-a4c7-a13f9b66386e", "value": "98304:MSfZYIyaACgs65ICiQkVtC4qlA4UO4oavMT2OxbROH9KhYvEDJmb:vfKs6X2VxnoaE31OdxvEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049968, "uuid": "ef23d519-230b-48ce-b557-8815d1e1d60d", "value": 3910597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049968, "uuid": "131a693a-1e28-4198-970b-c68986e4d15f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049968, "uuid": "48ab8b44-3c28-4b2b-9b10-39e10af1b685", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f69597e-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050062, "uuid": "a341cad6-a31e-4902-98c6-0e62841579fe", "comment": "Malware payload (Mirai)", "value": "78c481c0d7e40ce0b463c134e43edc4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050062, "uuid": "e21ca5ca-c52b-4b5d-bf83-abc1f2d42345", "comment": "Malware payload (Mirai)", "value": "6dbf57ca62926fc82de68719ab2b21dd5ee76827887fabba225510ff491510f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050062, "uuid": "ade73777-8586-4911-bac4-dc17ff9726f9", "comment": "Malware payload (Mirai)", "value": "dcf5b34229246c5d308d9e05ada5fee2e1a12320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050062, "uuid": "96847dbc-7cb9-4de9-8ed7-4862eaddc5e1", "comment": "Malware payload (Mirai)", "value": "2b6fd8c2b59e56d533b814800023f445539670ded572cd4b2eccb56d9165a71b666d34cecabce2558eef3e36984ed1d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050062, "uuid": "2b7f67c8-058f-465e-84ba-3fae1f6f78e9", "value": "T13883AD63C82B1D24D04848F0B0A48F3A9B63E115C99B2EF7959AC679D087EDCF6467F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050062, "uuid": "72e33e37-eb90-433f-a937-e164d2ef5d53", "value": "1536:HE+Lx1PNlHPgpiW6jKDbCCGrSq6CHi/PzD/29Ob:HhLxBPgpiBGDqrSq61/PPe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050062, "uuid": "fa9ec56d-ab44-4806-a0b3-4566d1941f96", "value": 81028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050062, "uuid": "cbb36891-5590-41cb-8c6b-674b34b2d917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050062, "uuid": "cbe861cb-d125-44c7-a68b-7542ebdb1b26", "value": "nwfaiehg4ewijfgriehgirehaughrarg.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018786d7-d283-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765012055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765012055, "uuid": "d48db739-fa35-478d-942b-54a08fa94657", "comment": "Malware payload (Mirai)", "value": "4f773ea8a3037523d86b5462e9346915", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765012055, "uuid": "1fee250b-687c-4856-9442-b9f3c72cb2ed", "comment": "Malware payload (Mirai)", "value": "6dd649ff95665ceb7d9ac1a3e601f2936338d8d8b928cb25f0254509e09409b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765012055, "uuid": "2284fc4d-c40a-4528-9897-d9161c7fa067", "comment": "Malware payload (Mirai)", "value": "53d693276a7de71f4598eef421226ac5354390e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765012055, "uuid": "1a34966d-2e05-4355-83ac-507faba20ff0", "comment": "Malware payload (Mirai)", "value": "c3a6da5714a3af279842846014e92836b2b6373ff17a23df7bdeea1009665c9e5ddd865c4cb38fed7993fa22c11b9a03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765012055, "uuid": "3e2e657d-391d-4b38-9f9c-c206f0e1140a", "value": "T10F559D48E783D8B1F59305F00E8FD3F325206B2A8057A6F2EB8D5A6674777532E5A318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765012055, "uuid": "c31986de-92a0-44ec-aa3c-ae32f28f1911", "value": "24576:KkAKAO5iEAljjOgtgWozMbhehhCU8UFvJxt0Pq65TtkAJkKdR6oWxGMx6XTa+:JAmHMbhehhCcY9Tt3BjWnx6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765012055, "uuid": "b24258df-9e8b-4364-a3e2-6a6d0a75a0e9", "value": 1371145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765012055, "uuid": "dc761c31-5e04-4198-a4e9-1490fafc4e8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765012055, "uuid": "1fa040e6-7c92-49c1-8bf2-d06414be3d0e", "value": "nginx2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78073815-d2f4-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765060787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060787, "uuid": "d0ca8279-aff8-4fb1-a815-1a54d842083e", "comment": "Malware payload (AsyncRAT)", "value": "732e3a8ab600888d465e52b147c09f22", "object_relation": "md5", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060787, "uuid": "12293748-9d6f-495d-b11f-4c9ccf8dab7b", "comment": "Malware payload (AsyncRAT)", "value": "6de38059ce607777a5dd93d99d4e5b8ad7552e3f105745389d8eb02b5899bdae", "object_relation": "sha256", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060787, "uuid": "dab12e0c-3d0b-40af-aa6f-cd10c855f245", "comment": "Malware payload (AsyncRAT)", "value": "df52f4a8788fd7bc3423a526a63b98eaa8b22917", "object_relation": "sha1", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060787, "uuid": "782aed2b-1ddc-4895-99cc-e71803cb7312", "comment": "Malware payload (AsyncRAT)", "value": "865e55db9f96aabc131a38088784b9f2ecb994eda385f6df78029bee678b91d5f707db2d6475c1f6161736f548bf158a", "object_relation": "sha3-384", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060787, "uuid": "c4a6ba24-7b0a-46e0-abce-a1872f3f5b44", "value": "T171233D003FE8822BF2BE4F7898F26145457AF2677603D54A1CC452DB5613FC69A426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060787, "uuid": "c6c483f5-1eee-4446-88b0-8deb8144a852", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060787, "uuid": "7c897159-a0a6-4076-a04d-fcf7769e3c5e", "value": "768:du361TFMBX1WUVLGPmo2qj1KjPGaG6PIyzjbFgX3iRztolr6D22DN2IrBDZ3x:du361TFqG28KTkDy3bCXSRzKJmQI9d3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765060787, "uuid": "c1ab220e-ec82-4c2e-a895-569af3a07638", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765060787, "uuid": "9894c436-a753-49b2-bd3f-3a765bc7fc0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060787, "uuid": "13d5bb0b-df05-4f24-ba44-c60f64106ca4", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e4c152-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981624, "uuid": "8b01e83b-d4af-4711-b7f0-7db3825ccc83", "comment": "Malware payload (Mirai)", "value": "4f47838f1c53f047277d1da3d121a5c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981624, "uuid": "811b6e23-6893-45cf-b3fd-f8995b721a67", "comment": "Malware payload (Mirai)", "value": "6ef5fc0df3fb0c7765ddc808a63fba888286409804221c2f2e68860dafc52e4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981624, "uuid": "27d87c92-bd81-4f08-b305-2489bc15186c", "comment": "Malware payload (Mirai)", "value": "c31cacfc286af8a1808f92e2828d69762dabd76d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981624, "uuid": "9a55d4cd-a779-4d1f-b613-a0fdc58a7cc4", "comment": "Malware payload (Mirai)", "value": "60a744da965f25fc0a7bc7d03db370262e6fb23669dc27a3d5948156d37f956a6abb3f5dc4dd90ea37d5e67fbdaa60d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981624, "uuid": "978b2f1d-8c61-4422-ab32-497f0f2ebc55", "value": "T1DBB32A81AC818A25C9D516BFF92E018E3323577CE3DF72229D246F2537CA92B0E77645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981624, "uuid": "78a76c2b-2d58-4a4b-a31d-496eec7d36c9", "value": "1536:mknUMrC+MfbmIiWsdjq4E0Tzyh16r1ROFaE5WW95xXTbag6STot8Mliv4wioN5n5:O1FL2zOQrDkdxvTbaZZRoN5n3uHONJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981624, "uuid": "0ee4bbd3-f357-468e-9985-9042c77b8305", "value": 109080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981624, "uuid": "5de6824d-7214-4053-810c-731352c93bd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981624, "uuid": "84002b6b-263f-4700-bc9e-4cba139de83b", "value": "UnHAnaAW.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00cf86d-d2f4-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765060962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060962, "uuid": "4a62f7bf-e6ef-4002-83a9-16db36647bad", "comment": "Malware payload (QuasarRAT)", "value": "129728e1f48b04efb1236900bd9885c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060962, "uuid": "0df359ac-cf64-4a11-bf3b-eaa3aacf8179", "comment": "Malware payload (QuasarRAT)", "value": "70555ddccdac70f3a534873f3e1049191e6a3f2b2e994b467d8ba663942a69c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060962, "uuid": "f99d0311-ec90-4346-ae62-f936930a0de3", "comment": "Malware payload (QuasarRAT)", "value": "abc15aa0ad07cac9dad3291a9c9496a387ab5f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060962, "uuid": "84c16bd0-3ed9-4343-bcda-8f31f724af65", "comment": "Malware payload (QuasarRAT)", "value": "1237d0ad354a49e97f8192b00bf13fd233957503fe86833f6d2852628e018469cf065f1a415878bde34f9a2ef6079daf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060962, "uuid": "89a2d5ca-845d-4d97-9ed9-a923cc3ae519", "value": "T15EE56B143BF85E27E1BBE677A5B0041267F0FC1AF363EB0B6581677A1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060962, "uuid": "1e815dde-ca9c-43b3-9299-bb7fd63e768e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060962, "uuid": "61a94721-a86d-4090-9065-32c41973f8d2", "value": "49152:PvvG42pda6D+/PjlLOlg6yQipVR1RJ6XbR3LoGdXfTHHB72eh2NT:Pvu42pda6D+/PjlLOlZyQipVR1RJ6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765060962, "uuid": "b443af13-788a-4a48-9095-e50ddcd233cb", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765060962, "uuid": "96a26bc6-fd0d-46fd-b566-09ec9b0c7c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060962, "uuid": "51b8ba9e-d1a3-4b24-8f3d-caef531d61ca", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28829d5d-d2dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050346, "uuid": "8b5678be-a8d2-4fbd-ab97-91107cd79b72", "comment": "Malware payload (Mirai)", "value": "8f03bf66c411f5b9ffeeb2a0288ff7ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050346, "uuid": "4ebd6ea1-997a-470e-a054-67561515fedb", "comment": "Malware payload (Mirai)", "value": "72c5894d91e3588927718331b8ee825760c0832c0716d7fb092d743d97fb214e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050346, "uuid": "c6d12d8e-495d-4372-8997-a79cbf855dbd", "comment": "Malware payload (Mirai)", "value": "8d85a76d8daad99f90405ee76a9d60ab4656efda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050346, "uuid": "77535b26-bda2-438b-aa9f-246ac9d5dbc1", "comment": "Malware payload (Mirai)", "value": "2fa10e1368401cdc4c18814248edcccbc4216c85fbf3efa692bbed10428b614c9a6dc5a61a46c77745687ed03fb566d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050346, "uuid": "2d881e6b-6a3e-4feb-929c-76c36c44234b", "value": "T1B4A32A56F9818B21D6C112BAFA1E118E3313177CE2EF7212AD146F2477CB96B0E7B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050346, "uuid": "e7a14925-ecd8-45e6-aee7-7eeacd048eeb", "value": "1536:ovnkgVcjRZd/PFt+rUsXLxp6n8aUGIQKCtDSi9rJvweB87w/p5iY17HmX:kVchXFUlLb6n8aU2rJvweB8E/pIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050346, "uuid": "7811e8cb-4ab7-40c7-a2f2-4a961e302cc8", "value": 100128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050346, "uuid": "69b9f511-f64e-4ea8-8a0e-49eefc94ab21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050346, "uuid": "f1356ed2-aa6b-42ec-a830-a2dd09617392", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394a42cc-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765033624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033624, "uuid": "78d27388-092a-4c4e-a6ec-7e17db3e2492", "comment": "Malware payload", "value": "df53c25243b31c85e00de026cf42bed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033624, "uuid": "76e5cd21-b708-40ff-bf3f-aee2bf8a77ee", "comment": "Malware payload", "value": "736b2c5782fca75a85379181bcf1d3a719a14cacd938d053c03b16041059dd8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033624, "uuid": "c60fa70c-8fcb-48b9-9bff-32bf644c3d98", "comment": "Malware payload", "value": "5ff5c29a8c4ce32bb757dcfe43670f44fa148a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033624, "uuid": "f50df172-0d89-456b-a493-cd3880c05dea", "comment": "Malware payload", "value": "28b63e195e68d18bbabb17228cd6585523901fc18b138131f3d2a547f9d8dc54c4882bda9d108260eadae0af2f4e7b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033624, "uuid": "7377d3bd-33c4-470b-b3be-1dfd92fd3509", "value": "T17D636B99776400BAD463827DC9E1DF55E672F80A077903CF52A8C35A2F637E09A3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033624, "uuid": "72f19472-be35-4361-8c6e-c45c6feb2bcd", "value": "3f6d921a7ee05c7d07bdfb59c4978743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033624, "uuid": "138bcf2c-1686-4323-a297-2b2ad34516b1", "value": "1536:NiccFLeZVkZ1+AFuaTPmDD7Ml7OcCK8c7g295t:NiYZauAuDD7MgcCK8Sg295t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033624, "uuid": "216857d0-5e69-4696-a621-3519bb2a7411", "value": 66880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033624, "uuid": "e7297640-0579-4a9a-ba13-fed2e9bf50ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033624, "uuid": "db84b411-4882-400c-8b2f-fec74ee60500", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d2f366-d264-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764998862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764998862, "uuid": "a061e3a4-f90c-4d53-b2a3-223d0250a958", "comment": "Malware payload (Mirai)", "value": "ca09211f1a6a2bd49f2ee49b17e956db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764998862, "uuid": "f357fcb2-219b-4b0f-8266-5ee93435921c", "comment": "Malware payload (Mirai)", "value": "73fb46792fa9370eb9b26ff95a940cfd4176f4a0d7437801e344da65f2e02c1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764998862, "uuid": "90788d5f-63ce-4383-aeac-fc338fd90540", "comment": "Malware payload (Mirai)", "value": "a19f22673a8fad454d4a7dd9b93ac4e69322ae7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764998862, "uuid": "faf5a1d0-d8e7-490b-8017-cdc2d3ab961c", "comment": "Malware payload (Mirai)", "value": "4971f247242a234c957b074e7d05d20bb9b4e5ee26caaae25cf17fddf899f96e1b64a5eca37673bdf283bee26fc81c75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764998862, "uuid": "bad8687a-4eff-4c56-b254-595ef89c0752", "value": "T1F4A60997B9924943C5E43A76B87D81C833A70EB98B9B56565D04EE3C3FBE1D90E38304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764998862, "uuid": "7988934a-4f27-448f-a1a1-07b8fd976c6e", "value": "49152:vRvgV+WxE6sjN1I2du4O8bSpFiJsROQDJgELMC8Bwtbq/29lCB+iiv/8J52KoEI:vRvMNxE6sndu4bbSgs1ZMRaA+iiMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764998862, "uuid": "8f09c01e-e132-44c4-b728-f7cb1b650306", "value": 10158232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764998862, "uuid": "3109fd10-5860-4fa5-9551-d91b4db18d85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764998862, "uuid": "089ec452-f1b0-4d3a-af69-ce641dbb6cf2", "value": "3.47_Stub_Arm_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed56f8e8-d2b0-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765031778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031778, "uuid": "2d2835c4-642b-4566-8480-4c28839f781e", "comment": "Malware payload (AgentTesla)", "value": "28c8ad589f65a8fabdafe7ba735ffcc2", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031778, "uuid": "1f2081be-7472-42e1-9607-81b606b03561", "comment": "Malware payload (AgentTesla)", "value": "74017beb00f7d14d7eab296b78266cb873d04dc18ad6917fa9c46218a8e005bf", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031778, "uuid": "f73ebabe-f666-4598-b9a0-e3618855b847", "comment": "Malware payload (AgentTesla)", "value": "01d332d39ed2d28440cfdfe0620397c34d82ec66", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031778, "uuid": "1273b1d5-de78-4b88-939a-cf563d0881aa", "comment": "Malware payload (AgentTesla)", "value": "7b13902af41b66711140ace4cf9ecd028788cebe1d90b103d7cc1ba01ce83cb8cc001cfee7c6c70b65d312a8827e8d77", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031778, "uuid": "2e646c13-db80-4489-988e-7390462ddc9f", "value": "T1AEE4334525303C24E4A7F2058847CC2981AE3AFF3D2766A2C46B29F6CEADD556E1C3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031778, "uuid": "7b3eae5c-6bc4-488a-a4f0-7f4d0472e39d", "value": "12288:hspvwSuIzI5lUNUI4zSym6WltnwuR5w6hShUSw9TrQNCLdRAxNfyz9nUW4aDzYRp:ip4SjzNuSFtwu3w6yRsBmKz3qRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765031778, "uuid": "793c0cf8-7b79-4195-b479-45aefaa7aeb2", "value": 673675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765031778, "uuid": "86a2b56c-7ec8-4d11-bff1-6392680d7bbb", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031778, "uuid": "9ee5961c-0887-41da-ab9e-d7d657c0c7a1", "value": "URGENT !! RE RE LCL FOB Shanghai- Nhava shevaTWVD82.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c57c2df-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050111, "uuid": "486c5fbd-7ed4-423d-b550-161beba89efe", "comment": "Malware payload (Mirai)", "value": "9d150fa2f882b22ab4d52c0bf20a0f25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050111, "uuid": "f9a0e5c1-4818-44d7-9d1a-179b16ca9b59", "comment": "Malware payload (Mirai)", "value": "744a5b1fd947d1428152f76e86abe8cd3894c40451bf73089b5fbb48a5b1e000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050111, "uuid": "47c62ff4-08d5-4f8e-9d8d-b083b13eab29", "comment": "Malware payload (Mirai)", "value": "6b51782b27d7315f674fe480d7a4bcaeeab822d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050111, "uuid": "c2aaafef-31fc-4a69-ac2b-76d55e152d62", "comment": "Malware payload (Mirai)", "value": "da64cca69b1974f3030a5d8c541b8883c6f011297e7d476c9f9d7c68bd06c42f9efb2290652476eee21231ee98c9704c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050111, "uuid": "af49b5fb-cdb0-4fff-acc0-8bf197c2cf71", "value": "T147933A56F9818B21D6C112BAFA1E118D3313177CE2EE73129D246F2477CB96B0E7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050111, "uuid": "f4825bd0-de09-468f-9b66-e59866a65084", "value": "1536:4nsneusFy6yogtc+f2PrM5amJZt0au5x8WCBD1iVfhGSgVA7pR5bY1gIN:4XFX+WY2PfyZt0aunfhGSgVAdR9oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050111, "uuid": "33fdebb6-933b-4f3b-b579-65656db45487", "value": 97464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050111, "uuid": "93d83de2-a711-4d7c-81e8-9c2e8944119a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050111, "uuid": "5599db67-b2c3-44fd-93af-f0099e23eee2", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1971c2f-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038657, "uuid": "4821b5ac-d47d-4ebb-938a-36ebbe4ac401", "comment": "Malware payload (Mirai)", "value": "4a406777b0bed4302cb0a876c9b4c641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038657, "uuid": "6eca9f1c-e276-4f97-b54a-0bc7dbf8a25c", "comment": "Malware payload (Mirai)", "value": "76908cb1145f875b8b7747e4d5cecf683e207660189068a99f7027ae0602476d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038657, "uuid": "6f13fc82-54e5-4e2b-89c0-5935cac5397b", "comment": "Malware payload (Mirai)", "value": "479b7641d8ae7a4b6098418f65828565088517b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038657, "uuid": "3373a919-7061-41d8-acd7-dbf0d27d2252", "comment": "Malware payload (Mirai)", "value": "c6512e988b17e18799070ccd2e1562c5574464e090f8ab4607f8a99027e0b38100a6337b863ef204f7c022c8170b7649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038657, "uuid": "fb5cdee0-9745-4276-b3cd-ed1958efb7ca", "value": "T1C13110436183F872E71204B7A5916F2B67748CF16072FF0A8F908C11FC352C4D521764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038657, "uuid": "8a056a25-d1c2-4289-b647-b0bb20e150b3", "value": "24:FlJq2zk0exk+6ahlKZFViZ6Eev3idSGZ8/Y/CeVWsNlzxHySuluoFRVacfNf1:fJyO1aLcFVk6EciSPY/5oizxSSu0gRks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038657, "uuid": "45c977cb-9fcd-4f0f-b79e-97ccb44e4bf9", "value": 1452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038657, "uuid": "7790913b-5dc2-47c4-9830-3e5f61d2f3cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038657, "uuid": "6a42f2a1-bb89-4a85-b01f-6f3baefd5119", "value": "dlr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b9190a-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042233, "uuid": "b76e1038-0b8a-47d9-9ea8-5ec07b3da2bd", "comment": "Malware payload (RustyStealer)", "value": "429452932f97ce51f0ef8b437d8c2c5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042233, "uuid": "bf539397-725e-487e-b862-a879bd8b7d66", "comment": "Malware payload (RustyStealer)", "value": "76b195b07a76037ca585b760bcf61462e836cc7ae990200e03c1bf7cec9695d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042233, "uuid": "4eb87320-25f2-483a-b4da-48de0bed75a9", "comment": "Malware payload (RustyStealer)", "value": "ff3118258cfc3f2973238cbbcac6d72f530241c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042233, "uuid": "8fbd5261-be74-4279-8b00-05ec60a5a098", "comment": "Malware payload (RustyStealer)", "value": "f38d0cc421df6fd0aebd8b5988a968e1f455751c0e5133c493bab123a40e32d24cea3ace001d3e4a2faa585c13b6cedd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042233, "uuid": "8fdb3a41-cdd3-4d0f-a968-0900d04ffaa9", "value": "T1CBF6E8E85DC858A1D257F83976997EF411323197EADB1E90C37CF9610D7EAB2AE0090C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042233, "uuid": "43d48400-415d-4b83-be2f-f02ce1db301a", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042233, "uuid": "6d96f443-a127-4aa7-ae30-e4efb1bd00b5", "value": "49152:eMe4BDCy6+TbpmhQGSyqQxcCkfe2VR0WhTP6F8fTo4:eMe4yQGSyYR3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042233, "uuid": "4730b65f-1d8c-4a26-b7b3-f0ad7c8e0845", "value": 15570944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042233, "uuid": "394fc544-86a4-411f-8328-0c46c13c47ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042233, "uuid": "cff5094f-d788-4e6b-9448-2f06af716a8b", "value": "multi_readme_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea02deae-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048952, "uuid": "1dfca3ec-8984-42ee-9889-ef94993b7e60", "comment": "Malware payload (Mirai)", "value": "bd1ade8944bcd71c68b4c09d6c165caf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048952, "uuid": "a3ae7eba-a3ee-4872-a3f9-e88b16f27708", "comment": "Malware payload (Mirai)", "value": "76c445c10d478c7a0212dd3e7199ad411eea4d856b2dbb252f9f945556984f0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048952, "uuid": "ce817c8b-d170-4f9d-82bf-93fbd174a808", "comment": "Malware payload (Mirai)", "value": "66cc4a99e2eec14a680eb9753b4596c738fe45f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048952, "uuid": "321718b0-d541-40f6-8c41-9b05c12ab576", "comment": "Malware payload (Mirai)", "value": "bb6cceeb54b43c3b915db22eff2f498a62c1a7835a3a3067a7e2d2fbe3bfb7cc2971ee2b0f9de1a3d211cc71e451e068", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048952, "uuid": "92937b50-2e80-4101-9bc4-352e38fee864", "value": "T19473B309BFA50FB7EC9BCC374AA92712288D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048952, "uuid": "71c535b5-24b9-4e8e-abdc-3b460327a3fc", "value": "1536:aHJtIFGq1QuT+uDEQhKvt191Yi8ZNFDGk:aHJtIM0T+UEQPi8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048952, "uuid": "dbfdebb7-262a-4b42-8e89-dea59545a1db", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048952, "uuid": "925dd780-9986-452a-865a-fa1f133252ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048952, "uuid": "693cd8fc-8d5b-4e15-bada-a1dcb345f599", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2600935b-d28e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765016841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016841, "uuid": "aeea6802-317d-44fd-8cb5-b5dc911c3218", "comment": "Malware payload (Mirai)", "value": "696119ba9930a9c204f3eb84b00d93d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016841, "uuid": "4797fb56-ee8d-42af-b44a-5c910dccacc0", "comment": "Malware payload (Mirai)", "value": "793b76a4c1a34a0c0ff21f1e0b5c98f7f9526846a20a670f059ac0b712cd6acc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016841, "uuid": "0b77276d-112e-466d-8cb6-e11219b58ef6", "comment": "Malware payload (Mirai)", "value": "860552fb4bbbdd6278fcc901687b7c9eefc60e1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016841, "uuid": "bdd4aa07-8d3c-44a7-97df-bdee470a5a79", "comment": "Malware payload (Mirai)", "value": "32a26ccd3a3da0c2e0b1f5bfe83aa3021faafe3b4661b2adeba2a7520c283839c23cb2b2b4ca02a252222ab42a8eb433", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016841, "uuid": "9cfb1828-27ab-43f7-abb2-f6fa054dccab", "value": "T1E5C33A86FD828A21D5D712BEF92D118E331327B8E3DE32129E245F2533C652B0D7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016841, "uuid": "15d33c3a-b29e-4f9b-b1ca-610ff164a0cf", "value": "3072:USgSFlESMmsnmnMzOaoBoslkz0pRkj894GU/:USgSnES5smnMKavgjpRP94GU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765016841, "uuid": "b6bb3c27-6dee-436f-9197-70115aa1cf2f", "value": 121228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765016841, "uuid": "5033d2db-e2d2-4a21-8dab-bbb61635dc64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016841, "uuid": "2ad59415-104b-47bb-8489-947b274f5935", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8af1c9c-d2c3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765039850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039850, "uuid": "2d304fc1-47fc-4542-8b63-d522498d282d", "comment": "Malware payload (Mirai)", "value": "8d607cebb7910ca226fb173c51c0c689", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039850, "uuid": "78174ba2-fb51-4e0d-a44e-7f266f677917", "comment": "Malware payload (Mirai)", "value": "7944e99877f80f96ac82dadc750f958d50a25e88885522b375eb38ae0993deae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039850, "uuid": "98c521d4-162b-40d0-b611-5d3d05a6a3fa", "comment": "Malware payload (Mirai)", "value": "19e080920f303a914775e9ef9ec38c780ac5d80b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039850, "uuid": "97316880-9337-4bf8-b3bf-e2c64b058106", "comment": "Malware payload (Mirai)", "value": "717e0530944691b17fa22adfe6fbdff87af877f7ce815b130d3542e4edd6a88ee82569d549d8ce1c0d5b7d4ad522eab5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039850, "uuid": "f5f775f8-a41c-4f85-be0d-470426ff0f31", "value": "T1BD1163BE024AA998C488D43B7292850DB0B64FDF54BB8B93DD55217D30B45DE7132E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039850, "uuid": "aa700310-59b0-43b4-8acc-e532ac00cdd5", "value": "24:kFRSaFl5QSaFnSaFqSaFA+SaFeSaFtSaFASaFkSaFXSaFAeSh:kKafHacaBa2aBaaaDa3aYaih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765039850, "uuid": "66b76ed8-7aad-401d-8a8d-52e1c2c60a2e", "value": 1049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765039850, "uuid": "eab22bfb-a6fb-495b-9241-50b0015b22b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039850, "uuid": "38cafe54-12b5-4635-845d-1c377224853b", "value": "pop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd0c7d1-d2dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050301, "uuid": "5ea48c0e-1dbf-4e8d-8f86-c56860e5615c", "comment": "Malware payload (Mirai)", "value": "05f3445c4f2a1ff269ffbfd1d6de270d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050301, "uuid": "b9bab136-6f41-48fe-957b-2b54894a4da7", "comment": "Malware payload (Mirai)", "value": "7951f9e0f8fe6894ec53c3f96a4b21dc35983c6601f536e27d86c59baf53fbe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050301, "uuid": "be75150b-1129-4c38-a778-d8dec545a57a", "comment": "Malware payload (Mirai)", "value": "3cd2807805eb2f9e217b2a478d77d6c2a28d4e42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050301, "uuid": "eb39e340-88c5-43da-ad6e-11c69d0ac435", "comment": "Malware payload (Mirai)", "value": "cfed0b0332bc81f31df31d33d955169feea629c03f5173b42b7be6cee354ec193ab091a139ef7c34b1f8f5528ddf1771", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050301, "uuid": "ff87ac2f-6064-44da-bee8-5eecb6de4be3", "value": "T1D513E11575066D16EE28E870ED2215C62A4049BC80D7717401DF82B827CADAF3D3BD93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050301, "uuid": "f6bb138c-a0e4-4d9c-9738-50b77c1b8934", "value": "768:LF4H4deo0G44eapi3UwvhaqdGy380HFWbWgGsbdv/Nnd6iYTuUAGAhJLjl9q3UEx:Z41BhaAqR8WzZdnNDYCtGKJf4Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050301, "uuid": "16b866b0-4f8b-4a5d-a26d-e53e76957c51", "value": 43792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050301, "uuid": "04f4f13c-a977-4531-ba64-cac59da71923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050301, "uuid": "5c7756fb-86ff-4622-a455-c504f1e793c2", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e03fdc7-d2ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765065522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765065522, "uuid": "8967f9f7-39bf-424a-a664-0cb16d11b75e", "comment": "Malware payload", "value": "fc54aefaebb0488f664843e7a703c396", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765065522, "uuid": "cf7fcd01-0e26-459e-81ac-213f9e64396e", "comment": "Malware payload", "value": "79811749a4199bc2ba4f4abe9d9bc0586ff2b2e74622bebac91bce4e236cb3b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765065522, "uuid": "fa36b4bb-eed8-4e21-b646-153d4fedf3d7", "comment": "Malware payload", "value": "e63862a41add3ea1e6c8c69fa316bff36aea70cb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765065522, "uuid": "a9ecca0e-f20e-4459-b4fa-139a1afb0575", "comment": "Malware payload", "value": "cc9431af27e4bac14928a3ac8694a9bb4cfcf4921330cc1b0048e1e06b3403d0a2356730e829ce1d041b9f1f419e34ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765065522, "uuid": "5a9c4dca-0f40-40ca-8e87-6fd02d015951", "value": "T1DBF05CB1F4145C2022AC847450094029F453E727532A2C5471F3C3343ABE692D55E71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765065522, "uuid": "ca42017f-515c-44c3-a49d-b16dac0b8633", "value": "12:Q6A/bv/S7FlGp+Deu7DBP/JLMEam3FmEOrxDZshVIY:Qj/bv/UbxnBP/ham1t2FZ3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765065522, "uuid": "e0db7b74-971b-4324-a662-285778a0c8f5", "value": 442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765065522, "uuid": "e9075476-28e3-482b-89e2-5c5f2f6a9fdc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765065522, "uuid": "93051f09-0fdf-43a4-bce5-37e016b07f76", "value": "cleaner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e64c64-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048951, "uuid": "6b0651ee-f102-4f30-9e7a-edfd540f1715", "comment": "Malware payload (Mirai)", "value": "f56d3de7fa364f8dddadafc16d73e357", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048951, "uuid": "1ba26445-91c2-42e5-b863-a4599a3e8ee1", "comment": "Malware payload (Mirai)", "value": "79f04fc8cbf92b1bef54e571d4889adec1a77970095c0a25a5a63f7acd443d5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048951, "uuid": "296455db-43a9-4a10-a2b6-118c854da3af", "comment": "Malware payload (Mirai)", "value": "da80d89c6a87cc33fad6148c69f816a5bb4b8f3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048951, "uuid": "9f023f73-401d-42b3-9707-3319729296ae", "comment": "Malware payload (Mirai)", "value": "ee392aeb18786f1ea6956346a92fb5f962fabc32d83b7bf78b02748534bb844d6c7f87be49aac705a5c4ba14a2ceac1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048951, "uuid": "a9866834-00b9-4a87-8c12-f4cb5eea345a", "value": "T11363F852B8C18E15C5D813BBFA2E018D33126768E3DFB2129D116F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048951, "uuid": "97d43fec-34ec-4cc3-b8de-dcf637d90e4a", "value": "1536:StnER4jL83+4/ZZM0mA8w7lR5vzq91dO0nz/IziSX+1/K:t4jo+6ZZBLbRd29P2X+1/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048951, "uuid": "b9574676-bfe3-48ff-9f93-a496e44edb4b", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048951, "uuid": "010fea7c-d70c-4def-9ff9-95684087bf12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048951, "uuid": "24720622-e91e-4bc3-8201-3ed421f6d9cf", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363b3ac2-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003124, "uuid": "aca5d691-1dc7-46a5-a619-890ee666b24a", "comment": "Malware payload (Mirai)", "value": "fb941b7d5b79e32604fa1a7088b6373e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003124, "uuid": "bcdc6d34-a2b2-4ccf-8889-78b58617f9b9", "comment": "Malware payload (Mirai)", "value": "7a60331e4c14e1c780acf4377a2b5230359f5cf9219302597d0510db4464fdbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003124, "uuid": "6f686190-a006-4aa4-8675-0476e67c9548", "comment": "Malware payload (Mirai)", "value": "22e7bcf9cafe3a9dfd4d7a9ac37536dcdc032761", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003124, "uuid": "1467882d-3cf3-4510-82a9-f79f81488da1", "comment": "Malware payload (Mirai)", "value": "c9413d240b64f5164590ac1de5391ff8460bf83ab341916878ee263767eeb5f80510d4360722412b2489c42c81f6c3ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003124, "uuid": "bc01e9ea-6010-42d8-b60c-e83243bf5369", "value": "T1AD8338C5E743D5F1E94700B02057FB3ADA35EE250228DE6FDB88EF36A972652A01721C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003124, "uuid": "bac3f2fe-b019-46b7-af58-dccbf8c0148d", "value": "1536:hKSSgwuiUXY6jXNxNEIyvcKi8JbEMfFOXKT3a1pUB31ksJ56or:hKSSLjUXYaN7EI4NE0FOaHasmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003124, "uuid": "5b7aa5f8-151f-400a-a1be-9f7830371620", "value": 86664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003124, "uuid": "0e9a16bf-8f5c-4523-b3ae-af5c7800d423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003124, "uuid": "14d2323e-e339-4199-917e-db6da77e1f14", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6081134-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765048919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048919, "uuid": "1f85febb-4e32-4ab1-b3e0-e50c0a51f351", "comment": "Malware payload", "value": "f18bb2f48b6d518efd708847c758d80f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048919, "uuid": "ca5ba088-6547-4ade-b000-3e0c3b64191f", "comment": "Malware payload", "value": "7b11536dc3834ed8de143c44f4bfcf34e79cdbf6670744257b09cb2f0323f0a8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048919, "uuid": "9da831bc-5053-498b-b6f5-eeceb4a2a32e", "comment": "Malware payload", "value": "80f2ac6c0b6b6f3f4c716e4c0f34b98fb95d205a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048919, "uuid": "ec30742a-d953-4fe2-864f-951e27034f02", "comment": "Malware payload", "value": "34c2e86c844a69dc76a36815a6e59c99f42fd447a828495fdd4b1b5dee6b5a82c11fcaedcbad2ac61f6b42b6dae03743", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048919, "uuid": "b5e8ee5a-52f7-4884-b025-1017549f0fca", "value": "T133F052CFF0628427CB2686EBDA1E539A3087F47C621028C7B23189DB878865026C60C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048919, "uuid": "6a1e4965-56e6-4948-96c2-0df5f8a64044", "value": "12:nP9NS6SJiS/S0LSJDeUMneVS5iqLTLYgaBBEuN5tRuNYRYUL:nP9wFn602jbUsByuTOKRY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048919, "uuid": "cd323160-fc88-4dcb-b047-4dcf75433e3e", "value": 530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048919, "uuid": "19459f0e-72ed-4233-b0f1-24495863b36d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048919, "uuid": "7445da86-350e-42dd-a84a-aca349d63dec", "value": "0daybitchkys.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebcf3b7-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050061, "uuid": "eb15d32a-7df8-4516-8405-6caf22529635", "comment": "Malware payload (Mirai)", "value": "5a5c8d4a81bdd9ca755aecb83191ccfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050061, "uuid": "61e38769-13df-4995-a22d-f2e4ddf28392", "comment": "Malware payload (Mirai)", "value": "7b612d6d0fb78b64bea7803d5be303f20905f359045fa11a89f5124711fca20e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050061, "uuid": "58bb3e93-fcad-4fca-a0cf-aee3d393efc6", "comment": "Malware payload (Mirai)", "value": "e5034e32125131a6d9638bc73d1612243ced5f24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050061, "uuid": "61706bfd-4bb8-458e-8506-46433cbe4618", "comment": "Malware payload (Mirai)", "value": "aacdf4e338e77f384c8a52cd61c428d5ebc99cf1819f9002f06682d319f9b4ce709956fec4f9b349d24da0379eb24e9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050061, "uuid": "6cdf069e-1ae0-4ef4-be3e-6451ea322c6c", "value": "T15C83BE73C86A0D28D44848F0B0A49F3597A3E116D5972FF6989AC679D08BECCF6423F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050061, "uuid": "a5e69d42-03a9-4089-8ba9-8d9f1b3a4e96", "value": "1536:qwJrLx9PVtqAQSfGhFnKGB6TNegKXCn12WrzOKpR:qQLxMCfGTKGAegKXG2KK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050061, "uuid": "146c7240-f5cc-4809-8a2d-61115cd496c6", "value": 81164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050061, "uuid": "ccceb536-15a2-43a8-91d9-ca4692050f4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050061, "uuid": "251cecd4-464c-4ab5-9d5d-8d188863841d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54603684-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042259, "uuid": "da6fbd6b-b538-492a-bf52-faed0045943f", "comment": "Malware payload (RustyStealer)", "value": "694461e8614dcef2384454bc167947f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042259, "uuid": "9a2f9fd8-446d-4a0b-826e-13369e44a40e", "comment": "Malware payload (RustyStealer)", "value": "7b7cabb207fcef9a856f86e78a0643bb84cc192f8d93221bde47da1482ddf85d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042259, "uuid": "683c822a-afaa-4b97-8586-d80dbdc66a23", "comment": "Malware payload (RustyStealer)", "value": "0b1f2f57643f07554c0495872aa4c953aeed1a2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042259, "uuid": "df0253a3-aad7-4b57-9f61-902916802994", "comment": "Malware payload (RustyStealer)", "value": "b52892f8d94090657635eb887eb6fcbf138d831dc1487ecdead61b347c9c67fd34ede47a2c7b67e069ab1faf93c9a1f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042259, "uuid": "5bf3834b-c5bf-41d3-9512-58b18f0524b3", "value": "T1D4159E1BF695A2BED55AC074830A8673B576B4CA0621BDBF11E1E7303F96E610F1CB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042259, "uuid": "417d2d67-9a1b-4bda-b866-27c2cc258125", "value": "87f0863ec927249773659ca301d7b700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042259, "uuid": "1a5820dc-e395-47c6-b03f-9c5cf230cd0a", "value": "24576:fo/LsbdptPssLSy4eMl8DlKiSHt8P5/W:fo/LsbP9ezeA8DlKiSN8P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042259, "uuid": "bccad08c-8cfa-4b54-be3a-4cb7715d812f", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042259, "uuid": "caead4e5-ebd0-49f2-adcf-89d824cf335b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042259, "uuid": "dbae81eb-9567-4292-9fb1-92b384bb7a82", "value": "safe_dec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d3e9f2-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043496, "uuid": "6049fa07-4484-4d52-85cd-1bdee9d31ea8", "comment": "Malware payload (Mirai)", "value": "2d5dc1d2d6c502722d953a8924e4a791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043496, "uuid": "b6c00017-2e18-4f21-9b85-977f057d830d", "comment": "Malware payload (Mirai)", "value": "7c16bcd6ebf34b37190ae1e1fd854a8f6ea5a9cd61663df8a81816a96ab58ee3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043496, "uuid": "66d3faf4-af46-496b-8c67-cfe7a226865d", "comment": "Malware payload (Mirai)", "value": "6ba07ff731071045ae77131e771070c78685355e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043496, "uuid": "2000b8f6-88ab-4f4d-88ab-e583054a4442", "comment": "Malware payload (Mirai)", "value": "eca92cb86bc5f0280943dfe1277f058ecd381ea99a82998ecc2f908a180998ca6fe074543b307e74720f70683ca54160", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043496, "uuid": "2253eb46-8ea0-4f5f-9749-42bf8a87af17", "value": "T1C993D506BB650FFBD86FCD3746A9071239CC550A22E93B3A3674C91CB51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043496, "uuid": "fd2c7557-74b5-4310-80ab-f2a20ff3e5db", "value": "1536:lX1tMe0R/thilQZEvPgaLiVw0FmWnM9kyXZLHLQq7V861yMRVz8Z:lltMe0R//hEp5Wn2XvJVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043496, "uuid": "5316ea17-c438-4310-a227-4b6d093768b5", "value": 93464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043496, "uuid": "8315773c-f07c-4064-b48f-e633bf1ec34e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043496, "uuid": "6b779ef7-2bb8-4101-af6e-901984e40701", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8a59b8-d2b0-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1765031726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031726, "uuid": "58a9e5eb-52aa-46e9-9038-71346b8f9e84", "comment": "Malware payload (CobaltStrike)", "value": "7170a9841339953ff2e7fa3d57b6d1fd", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031726, "uuid": "2a7e27de-0622-4ef0-9c75-4cfae22de146", "comment": "Malware payload (CobaltStrike)", "value": "7c653beb8859964f06f508f963bc9e7440f71a9a7558f1a7f61d99e12b82fc98", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031726, "uuid": "c2c654b3-2826-4f2c-8293-c071a30c4eb5", "comment": "Malware payload (CobaltStrike)", "value": "d7e6dd3876e2609320e29221cc73c8c51538c2d9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765031726, "uuid": "2dceb982-2ce5-4fe8-b391-ca7e624ed565", "comment": "Malware payload (CobaltStrike)", "value": "97ab7f246841812832d51e9ba8666ae43d4ab37725bd1416d6a9ddd1df82efc8cb57c698ac097486e1d801533a68e037", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031726, "uuid": "b2827041-43b3-4117-9ca1-02bc5a0ee71a", "value": "T11223731ADD2ED0A7C279A874D5421519FC617CD68BF8A7C3AF410DC606B3BE4AA3DB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031726, "uuid": "5dc60dd1-a57a-412d-976a-fcc4e1db48a2", "value": "df1c8a39b2d76c252713425650d481e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031726, "uuid": "1901c3f9-78c0-4c16-b5b3-5472c4665c44", "value": "768:L8r40O85XvHSYrN87kPQqPQvtD/eJLPwUFqN5bTtDbI3QOC:L880fHSYrNojD4L8p3DOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765031726, "uuid": "6707dd72-84d5-45a5-b9e0-a8ca8900d0ed", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765031726, "uuid": "24bd86b5-ab4b-4fed-b7a7-c8c870ea48e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765031726, "uuid": "d9939fe1-77a1-4aba-a3ec-b0dd59672adf", "value": "SecuriteInfo.com.Win64.MalwareX-gen.27131677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b937b189-d2c3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765039851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039851, "uuid": "9ad6327b-b792-43b4-bae5-bc287095207c", "comment": "Malware payload (Mirai)", "value": "9ea9dca90d9347e9c8111767cbc1dd66", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039851, "uuid": "6f0a4170-52c5-4959-ab2b-a6c7b9350e87", "comment": "Malware payload (Mirai)", "value": "7d4fed7c9fc2f2a1e2aeee6a776525152768b8a2030ee33c029a10e4f8024fa8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039851, "uuid": "38345b1d-8105-4055-9535-65ac83a912a0", "comment": "Malware payload (Mirai)", "value": "e0cb4b3c3f78fd7e2bec86b1a7369f43b7f07795", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765039851, "uuid": "7efae269-b43b-4af1-beca-c3e5f8646ff0", "comment": "Malware payload (Mirai)", "value": "dc5862ae0828093338e4653a19a9ec7821194c4239338ed1e7b8cc3737bcd2244147b9570de025aa36c0c8a8a65880ae", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039851, "uuid": "c3a6d780-0abf-48dd-9ac6-172af6ed915d", "value": "T1CE1184FD042DDF2781085A1BBA59783670BB07AE787B87A8BFD47859344C8603132E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039851, "uuid": "6c107f6d-9626-4341-b918-ce80d7beb620", "value": "24:6ql5f6BXAyGnhi/t0FnjGUIKTE1jn//ZxAnAL:FZ6BwDfFjGUIL5j3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765039851, "uuid": "3cf3e423-99ad-46ec-855a-1b6f7a7f6da1", "value": 1009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765039851, "uuid": "7f329728-5ebf-434e-927c-ffb0f10a43a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765039851, "uuid": "aaeec030-1ece-45e0-a6d5-d0bc443338cd", "value": "wg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4f381b-d279-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765008052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765008052, "uuid": "aa89ab85-5d29-4571-a70f-96f44e00ad11", "comment": "Malware payload (Mirai)", "value": "b46e4ef64f12713389d2b216cb987e5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765008052, "uuid": "2dde2aa3-fcb4-4f46-9b1f-13a1a3e6ac2a", "comment": "Malware payload (Mirai)", "value": "7da1a369267bcd4ca804090e4053c887ec6379e70f1fe247c064ab8e32411b30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765008052, "uuid": "071a002c-a7c7-4671-8cd5-39ccc931343e", "comment": "Malware payload (Mirai)", "value": "c1f7c9e420f6c65cf4fc7e973b7c0a1015216be8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765008052, "uuid": "89f811ca-0ba2-459e-9a6f-0e9058d72116", "comment": "Malware payload (Mirai)", "value": "be5ad979813d0f0b7294a9c30292b59ed632bf31d05dcb5ddb7c3578c6f881bf16b8a9e1da2540793fc56f843d10e83a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765008052, "uuid": "9e13ac90-a793-4990-b2ef-a18dea00307f", "value": "T17383E82EE662D33CC086A2745FDFC2E0627470B86B31225F3B41567B2E616D99E36707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765008052, "uuid": "285c09ab-8e18-4611-a293-27fbbcadb4fa", "value": "1536:1y8AoXPAnqzRYzVQWlga5qf5dvx/5mtF+gQm:I8BXPAnqzRYhQWlMRVx/8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765008052, "uuid": "cc7e5574-ce1b-4e57-8e02-fab5926545d1", "value": 87296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765008052, "uuid": "c60f86dc-521d-43d5-bf97-3f2f9d3aea42", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765008052, "uuid": "241fcac6-ccd0-4b6a-88aa-17c87ba0fbe5", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9bea4b-d240-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764983621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764983621, "uuid": "f916e15a-ef7e-450d-a21b-10a7eb3ddea7", "comment": "Malware payload (Mirai)", "value": "622f904bb82c8118da2966a957526a2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764983621, "uuid": "e2142e2e-455b-4ba4-b14d-37f6ae2cf47e", "comment": "Malware payload (Mirai)", "value": "7e0a0c48ee0f65c72a252335f6dcd435dbd448fc0414b295f635372e1c5a9171", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764983621, "uuid": "26adbe4d-0409-4d88-8aa7-8becefa3f3fd", "comment": "Malware payload (Mirai)", "value": "09e42ebca5a59b128246a08827c040220ae1c2cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764983621, "uuid": "054dd9e9-09c3-49a4-a476-f067ac4c481d", "comment": "Malware payload (Mirai)", "value": "62580aaf37c8c42182125af2c22033981a97bbd44636f3799b114e0ab2a175ed73d822122ddc92a55c0516ecef1fc39f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764983621, "uuid": "60dbb218-f67c-4a2d-ac88-e8985861c9fb", "value": "T1E70633F9E29F9ED35BA1F6BEA1740950000D403A4DEF95F09BE022A1CC79878766DCB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764983621, "uuid": "30163661-73e3-4b5e-8bc0-94dc34d6e9b2", "value": "98304:F3y+o0nmFxjoCRv0++N2JzOzC9t8xpX8Ye252:F3yHxOc0/xpMK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764983621, "uuid": "df4469cc-e418-4fc5-9928-9643db3cd42f", "value": 3681612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764983621, "uuid": "4d31f4bc-a318-4b9d-9bfe-9bec6ce64f2b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764983621, "uuid": "f907197c-c6b9-44bd-9484-3a3a24124a0b", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6b5a84-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050161, "uuid": "07ba5ba8-ae63-41ba-afa5-aaac8b1691f0", "comment": "Malware payload (Mirai)", "value": "03d238bb7493dbdeec314a033f7f1d97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050161, "uuid": "9daedcd4-da28-4ea8-bf9e-9f80fcf4b15b", "comment": "Malware payload (Mirai)", "value": "7f1d313778c7fcc6795926394533244b32b34d82fc314cb8a9e8a71833b2858b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050161, "uuid": "fc255101-bc97-4fcb-96a7-27d3963fea37", "comment": "Malware payload (Mirai)", "value": "dff16a9699ad72e9e1b4d1c66dddb1896726bcfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050161, "uuid": "9cc78695-f59c-4601-b439-875827c1569a", "comment": "Malware payload (Mirai)", "value": "8691d1fd2d55292b39d7aaecb6acca92a88d0b43b86be3d765c9ca327eac8870344f5dadab0cdef8589b65d271e7e5b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050161, "uuid": "82851327-089b-400f-a4f0-4170e63341f0", "value": "T1B6736CC2AB47D4F4EC2605712077E7728773E13E102AEE83D769AC36ED52941962A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050161, "uuid": "786b11f7-d980-45bf-94d5-08ef2ed32e5c", "value": "1536:yUQvN+2LhctKMnIpmQ3Pk798U755e1j+b:+lVoKMngmQ387O0P9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050161, "uuid": "cc28cb8c-c375-4357-808d-cd569ea992a6", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050161, "uuid": "bb2919b3-af37-4566-b0a4-c54e7a21c7a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050161, "uuid": "f050f33f-ba59-42b9-8514-ef7f8a024383", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f440f0a1-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038662, "uuid": "1cd8dc5f-58de-4881-856b-cb965beabea3", "comment": "Malware payload (Mirai)", "value": "4ae8051dc32db70a77bbcaffa34473d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038662, "uuid": "538d8638-85d4-4cde-877c-28bb9b49de95", "comment": "Malware payload (Mirai)", "value": "7f485a6418e7d290c2212d0f39b72c766c2adda76520b5e341af2c4c7b715edc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038662, "uuid": "bf9049ef-48e6-4d18-9bfb-5e0f6e25bcba", "comment": "Malware payload (Mirai)", "value": "914245d0d79d69f85fe3921f60b422b5e01ee491", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038662, "uuid": "76cfb8fe-2687-4732-9011-c5c165e1bc0f", "comment": "Malware payload (Mirai)", "value": "6a28661e4ef83fad28d08ce8521c3157e3a4b4a4b582ad85a9727f68df957c39e46c2428039ca5411e8598fa02e0eb85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038662, "uuid": "3837b5a4-c337-405f-8787-f42448a19c94", "value": "T16731530EFA88BD04FF10CC3899257B752F271D2F440EEA9B4D1A85B4483B50C31A52AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038662, "uuid": "a1a87ce8-f214-4928-8265-cb4310b83a7b", "value": "24:PxKkiDQUpXFpcDQWpVE2wtuYiAQWfq5sfnMrkHgAiZXgzN:phPUpXT5WpSjbirxyvMrckgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038662, "uuid": "554bc244-480e-451c-b091-6a9c28feb3f3", "value": 1508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038662, "uuid": "d8f8725e-9cb6-4b76-9e77-852df3d3092f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038662, "uuid": "8a96ff8c-21ed-4c67-9acd-9de98f4167f1", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9981f79-d28f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765017545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017545, "uuid": "b8c8e7e4-29bd-4487-9656-d1d559c47dc3", "comment": "Malware payload (Mirai)", "value": "26a7059e162982f3f4130fd7052dac83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017545, "uuid": "ccb19acf-f0b0-4219-b1dc-cbc4f97df47c", "comment": "Malware payload (Mirai)", "value": "7f669b370b8bce7fe8b7c5bdad6db3678cece3b75e6cd55ec686515bb325cc4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017545, "uuid": "17daa571-62b1-4784-8230-4cadc34b64ca", "comment": "Malware payload (Mirai)", "value": "4eca0d2323f02c1ccad1f602666cb2948981f000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017545, "uuid": "8fc7ed10-a76b-4cb3-b260-38309c223004", "comment": "Malware payload (Mirai)", "value": "988b2ec5ef2e38e1d0ac58ba5dd7f9ae918e4663b4b61b87ef5a0e5cd8005ba01330ce2d2ecc87ee942ecf70c8341c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017545, "uuid": "38c51fde-9c03-4aa2-8b95-0d8b65363bc2", "value": "T1B023019AC2F29800E81E733E447EE92E2250E0547E58B1B6F4D4F1717592BB9762C267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017545, "uuid": "01d5e457-2c55-4317-881b-32848668ea84", "value": "768:/yFkE+cnOmzrGVpRhEGq+UyNxxX9nLNWuyUzxxOccdbihBt/MXXw8Nlegjnbcuyd:/yFOUUpRhffx/LSdbijt/iXHleynouyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017545, "uuid": "3a1e3bea-b67c-4ca9-83c0-9cc9c6f59ae2", "value": 47408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017545, "uuid": "169293b4-8f09-4b7c-bb58-24c9eddaf63e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017545, "uuid": "1b4b668c-2f34-46d1-9cce-7661ca2019c6", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e3fec7-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038663, "uuid": "ee49e961-646e-4f7f-8253-0848789bdde1", "comment": "Malware payload (Mirai)", "value": "99fed81875aeff728ce83c51485fd087", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038663, "uuid": "07c40134-392d-41ff-b757-cd135d3135a8", "comment": "Malware payload (Mirai)", "value": "7f76094d1ce4290b5663f34cba9f51ff251134c45a7bb3ca91a239495e5fcd52", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038663, "uuid": "96ca3619-04c2-4b1f-9308-5c3290865b1d", "comment": "Malware payload (Mirai)", "value": "d5e04986b34449456a5edacc055acc17f6a7dba7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038663, "uuid": "d3e4e959-0933-4f72-b201-fd2d70eb3580", "comment": "Malware payload (Mirai)", "value": "aa5a289a88844c6970628ba3be15ff00bed20542c09af44c4fec4a64345b137e41b4c824183677f940bcbab4e4676702", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038663, "uuid": "7022afbe-c6f6-4878-a0e5-e784a01c6e1f", "value": "T106F0B4EDF4734073B80DAF1BE174834DE152F69965E42A6088D77C09A82DC153492637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038663, "uuid": "2a96d3b9-e950-4d66-b410-d6f651a7251d", "value": "6:h9OnFflE0FJBodAjJdyzNdyuGjJ60hMwXJfLFNfZ5B/pEa5YYIPadyivpps:d0FJydAjJdyzNdyuGjJ73JDhZMuvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038663, "uuid": "e9f7d79e-0b7c-4ddd-9298-87754b08f69a", "value": 492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038663, "uuid": "9f20bc51-6407-46dd-8e34-7e4776243d3e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038663, "uuid": "f4d8e1af-80eb-4659-99bc-e1dcebf9fb9e", "value": "fttt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf9cc84-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038649, "uuid": "07d52f2d-3c70-4749-9658-db2765576da5", "comment": "Malware payload (Mirai)", "value": "4a74836ddf3e2f7ebd406e990596a581", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038649, "uuid": "84a57614-3f4d-4d9c-b94e-a76d43882b32", "comment": "Malware payload (Mirai)", "value": "7faf93f57be3538d0a9c8c808ccddedc9d1e278dfc0cb3207c82b5e6d443e580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038649, "uuid": "a4f36791-ba48-4b63-9500-12bb1425b38d", "comment": "Malware payload (Mirai)", "value": "9cbc147f467292f5259b527ff7f3a68535700ff7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038649, "uuid": "d7d1dd4d-ce0c-4441-94ff-a09c610c2b77", "comment": "Malware payload (Mirai)", "value": "d48d60b15be89840579913dbc736ff93da94fdb83a0ec496268b99c73bc2f9b86762db1206786f78cf122cc8c58ddfa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038649, "uuid": "f17a8d75-cc1a-4691-b983-e6de2ef9dbd0", "value": "T163732945B9828752CAD923BEFA2E018D33296798D1DF7257CD212F5237C692F0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038649, "uuid": "18537986-e8e4-42de-8b2d-9fa7ddd81311", "value": "1536:E+LhYXvarx6KV/ta9ty8XBpuAh4HGLGjSQDWeZrMwvjFYz6zG5eHv3:pwvarx6KV1Q0keAh4HGi+rgwcjFYz6zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038649, "uuid": "fb42d985-6d21-492b-b5b7-0c66e0bdf1d9", "value": 79512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038649, "uuid": "77e98d19-63f2-47f6-8c0b-29f6a71d3c9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038649, "uuid": "2c4c702d-6eab-433b-9f9b-d4e7d1cd9ba1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf6d653-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002411, "uuid": "81d99d93-5f33-4bdf-88bc-20a2d272cb08", "comment": "Malware payload (Mirai)", "value": "79d9ad908e43856396d3d04b1d1f9d2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002411, "uuid": "95e94aaa-7372-4ec5-b1b1-26b91641ad61", "comment": "Malware payload (Mirai)", "value": "7ff0414dd57c9811a3711f3f12a66a611dd0adb00925b44cd728bc81e36e07fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002411, "uuid": "1fee5e87-7257-4413-a7d4-ddab8b80bc2e", "comment": "Malware payload (Mirai)", "value": "cd90fdae8c9d1a087cbb3d1eb256a2c23f28c7e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002411, "uuid": "bf121b0e-a5c7-4450-9585-3d6e319f5545", "comment": "Malware payload (Mirai)", "value": "2176a6df845b141fd0128473a7ca9a80ee414f1f5045a51b5f442f336babeb3625284f438f938190afd785a4f94a70c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002411, "uuid": "bf3a64b3-67fd-4533-9ae6-b90bf617f21f", "value": "T117357C1BB2B3B4BCC107C134579BCAB15531F0B926222D7F67C4CA342E6ADE51369B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002411, "uuid": "b207a379-e489-46f6-941a-a5a1ed8af97a", "value": "24576:WAM20fTFmmb8b968eNuzcaTgaGL+tWRhWKl:Z4ICNuzhAL+0Rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002411, "uuid": "456c4991-5caf-48fc-8f4b-b7999fbaae92", "value": 1090088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002411, "uuid": "6f977af4-8332-4534-9964-471aef09cef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002411, "uuid": "d4d0dd19-2ea0-4b15-9ea2-aeca39639b4a", "value": "colonna.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c70c3ef-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049171, "uuid": "a4b96a21-5719-47f2-9a4b-f3addb2da3ee", "comment": "Malware payload (Gafgyt)", "value": "701b9f605f5976c20afae02c7eac551e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049171, "uuid": "3dca7b07-f61c-4f7a-b4f1-95ed87a41677", "comment": "Malware payload (Gafgyt)", "value": "800765492fdb6e8c32c45872c83b24cf9b783f1d89253a764df4e72c47957cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049171, "uuid": "151ae0ae-4c4c-496d-8a97-b7280a53847e", "comment": "Malware payload (Gafgyt)", "value": "1863d034918cb83ace7ed35ebfddd949567b6303", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049171, "uuid": "3c6c398f-71ad-43da-8275-c025c5b186cf", "comment": "Malware payload (Gafgyt)", "value": "c7ccc5f332eeb7761335710e1d0fad8cb3fa67d71abf1a1b9dc1ef9d0f6ef5fce933d8c1f65762ff474ce039a8225ba9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049171, "uuid": "d3961ff4-47ad-4115-a759-3b3859632864", "value": "T1D6B32945F940872BC3D327BAE78E479D3B36179467D733116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049171, "uuid": "fb8450aa-b222-42e5-aaf0-b0501e5c161d", "value": "3072:k8u0eG8AceBIC8lPi6Ra9KomkZrQAhPDCXFke:cG8deBj8lP+XmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049171, "uuid": "b382490a-9ffb-4014-b284-8e33b5b58335", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049171, "uuid": "d8099cd1-fa56-43e0-bc3e-1615770d3e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049171, "uuid": "ca5a650f-f2ea-4fde-9212-137ba23b2fd1", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650881cf-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042287, "uuid": "498912cb-8ae3-469b-b204-bf9247d9fa04", "comment": "Malware payload (RustyStealer)", "value": "e440a3cb8c8b5bf20069ab4ed3f2439d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042287, "uuid": "727f783e-d97e-47d5-be97-74cc11a944b2", "comment": "Malware payload (RustyStealer)", "value": "821ea5d058f9e714847d05e2a864bf3e713eed145c3ba82fb5c80e3268fe0cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042287, "uuid": "0a68b63f-0205-4847-80a0-0103160a7c55", "comment": "Malware payload (RustyStealer)", "value": "48b288f895d0b0a13073b4acb98b6ff8e4874423", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042287, "uuid": "6b6c4574-4d67-4f24-8d7e-3b89be22c557", "comment": "Malware payload (RustyStealer)", "value": "90578b30370ccf954894084568a85cac6c361a27ee10f5e6fe383b27900cbc752178c187e3abef21813ae7b74bd94f75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042287, "uuid": "2124713d-3a74-409e-a150-70ad47b82a0b", "value": "T1EE857D07F2A581EDC0AEC1B48347AA37BA36B4890621BDBF17D59B702E65F514F1E708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042287, "uuid": "55b2c19d-1660-4a4b-bd38-7f32412db5e4", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042287, "uuid": "cf7327ea-bcf6-42e2-b211-949af41f32f0", "value": "24576:ylM0DC71ke9DmrZERS4w8GSy5+BOmh5KisQQbFeqk4k8Ru/J:ylMOC7wERS4w8GSy5adkQQbFBkt8RuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042287, "uuid": "9643bc36-1e12-426e-bb66-8ab89a7a008f", "value": 1715712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042287, "uuid": "759cd662-105a-4d75-b3a3-8308d63c162a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042287, "uuid": "d6c137c9-d67f-40ed-9ad2-4ae90d8b5959", "value": "test_pervictim.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54f859c-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033832, "uuid": "2f0afc10-42d8-474f-b93d-9f950d6cfe27", "comment": "Malware payload (Mirai)", "value": "bd865607db36bb08005845472ac30b8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033832, "uuid": "7dddf81c-4b33-4438-9c3e-709099f11e46", "comment": "Malware payload (Mirai)", "value": "8363627267a2613d61507477a9c8ba6019b807fe511f40f3181a563dec497661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033832, "uuid": "c3e8d818-0027-4573-8045-f0f34cc9cec3", "comment": "Malware payload (Mirai)", "value": "49918eeebdcdb7e77cc08fb27999c44b8b320e80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033832, "uuid": "7ba8780e-0b9b-4f82-8b78-009f0989b927", "comment": "Malware payload (Mirai)", "value": "a5de19a166e83dab81854d82928444361c229b9f2d87e7ebd0e7f10b1e6a1bbb17ea5eb1fd0cf9af881d0577c409685d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033832, "uuid": "d6bc676f-cebd-458c-a7bb-91433fdd0b2d", "value": "T145A2D09DF55A1E80FEAEAFB208CFD2CBEB540A4A73C4CC8214D15614DC43D2B5B199D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033832, "uuid": "02126dcb-2e65-4d3c-b15c-b12b7e4ff61d", "value": "384:c9ICojPedF4jdNjD9w93GlEdwWElWhFOyv3XOeT+LQAfQjThM4uVcqgw05VxJc:mzehNlwI8wWElWhFOyvH/LHO4uVcqgwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033832, "uuid": "da363d9a-4520-478f-b01e-c3d29fe3084a", "value": 22232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033832, "uuid": "f8436e47-a3bc-45c3-bc16-b7d5727b9103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033832, "uuid": "f3b605b2-8a34-4d24-883c-be6f0878d216", "value": "b3astmode.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aa3990-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033913, "uuid": "03dd8a8f-2131-4b81-9be9-5b27405bac11", "comment": "Malware payload (Mirai)", "value": "17efb396d6090800c1f2dde050fdfca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033913, "uuid": "c749a58c-3327-45a6-94c8-950e700f2fec", "comment": "Malware payload (Mirai)", "value": "83713aac9deadc3a3c29fabd776f1261443c3725b9a9138992458b12dc487a59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033913, "uuid": "d3a59933-0255-485d-8e5f-26a38b133dad", "comment": "Malware payload (Mirai)", "value": "b97bd0693e333b8a9b185f8f16290f9e250f6f2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033913, "uuid": "eda11043-43da-4c82-9598-5472400c6098", "comment": "Malware payload (Mirai)", "value": "3143da1b8bdd7e320f2e9f5233e64580fa55af73e0088d6c61c3212e7771ee12f651c0395a7e476d5eca242ec884b680", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033913, "uuid": "c370df81-73a9-441a-bff5-d9917f9d5d67", "value": "T142636009BF611FB7DCAFDC37099A174124DD651B61A83B69B930D818F31A24F1AE38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033913, "uuid": "749c737f-31b8-4440-a46a-19b2a800c333", "value": "1536:92VhIeHeQFggLOIXmXDDd0NcsRZ9HwQprY:4VhIe+QiQcsRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033913, "uuid": "988efda8-3f13-468a-87f5-2e125e10886b", "value": 67744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033913, "uuid": "8043a598-5def-4a00-bdde-b4c16e18386a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033913, "uuid": "edefd2a6-1dc6-4a27-9f55-e05dd697825e", "value": "b3astmode.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51d10d9-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050125, "uuid": "b592eff3-9ab6-4d88-b2db-ce0ce831d482", "comment": "Malware payload (Mirai)", "value": "aacb407cd10958acf37e36752eda93c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050125, "uuid": "4f6c05bd-f164-4179-8776-bdec8a58d083", "comment": "Malware payload (Mirai)", "value": "8461c86ccbb736b2b32c613df575cc7c446fce17e8b7b30bf9d6bb0377ede42e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050125, "uuid": "3655ab84-5531-405b-9aff-dfdb61b7ae20", "comment": "Malware payload (Mirai)", "value": "b55f02c7052a0e37fc2a1ece97e94658bfe16814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050125, "uuid": "59518f80-a311-4314-ae62-e041663829e3", "comment": "Malware payload (Mirai)", "value": "f60c42d6b731e6fcada22f8c52d74e8a00d89d18253cd7e6158f23ab4ed63ea18938fe014bcc541dc58eaefc156cabc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050125, "uuid": "157452de-b6b6-4b11-995d-f323a1410e9e", "value": "T10DC3F609EB610EFBE86FDC370AFD070525CC651722A87B7A7574D928F64A24B09F3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050125, "uuid": "4b63fa48-ce47-4191-b769-21480963a309", "value": "1536:pOWeUSZ25TuMePxR0hFXh9guwHW2qDOUu3up+5iQ1vZZO2WNEMvlOKvj8tjlBqDB:0WeUSZo2R0tHk5iQ1ZdgjuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050125, "uuid": "32464730-925d-41f6-a470-12d9090e7f06", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050125, "uuid": "bd57cf0c-5589-41c4-a7a1-5d3c0d650af1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050125, "uuid": "96d8dce5-3abc-40e8-8385-1999a9f45e11", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b5cf12-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048939, "uuid": "a2831845-8cc3-4c0d-bb47-6f7efc141c53", "comment": "Malware payload (Mirai)", "value": "1b3e47f8b804e2a8d7f3618a0a86233f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048939, "uuid": "bff675af-84d3-48f2-bc84-5dd364e17e77", "comment": "Malware payload (Mirai)", "value": "84e2ddf21bf272cb7f13f81a3e8ae2be1b57cf94c9bc5524585eed535e40801b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048939, "uuid": "3fdaa6c1-3bc0-44a6-a0d2-8e13ad058319", "comment": "Malware payload (Mirai)", "value": "566200a0616a937456eaf8ac37fedf6b856a25cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048939, "uuid": "13c9c9ef-3e36-46f3-950c-d9f36be8ab2c", "comment": "Malware payload (Mirai)", "value": "b9af1ff8eb39568ddce8646f7962ee8fa6fea878a36b1ba46a91320c84ebcf48bf5a51571e9bab365033360c6f3f7fcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048939, "uuid": "7073b575-29d8-4f6f-ade0-a122ff37b73a", "value": "T132D35C0677180E57D5A34AB0263F1BE083FED5D121F4BA89291F9B6A4672E3B5481FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048939, "uuid": "acb032e2-74de-4024-8f1a-9c22e84e4e96", "value": "3072:JUFczWKNZhc3JiwmS7NHr2Um/u4SM89tk1b:DvNo2khr2Um24SM8Pk1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048939, "uuid": "6d8321a2-bd61-4e9d-86e1-264a47646b95", "value": 134328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048939, "uuid": "18959875-74e1-4d14-90a2-a5274e2c21f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048939, "uuid": "dc81041e-b4f0-4eb4-87e2-6a8de69f9f7e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc1d0e3-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049843, "uuid": "64a92995-6211-44ec-acd6-a5a6be22b217", "comment": "Malware payload (Gafgyt)", "value": "e531cae41cf6884cc37088863337af8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049843, "uuid": "bfab9ccd-c0e2-48f0-a461-d6756b503842", "comment": "Malware payload (Gafgyt)", "value": "851515b43170cf56238ab7a49b68fe8f880ede6643f203b9e036c7324da2f7d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049843, "uuid": "33059b15-756f-475e-be60-ea59caf396f6", "comment": "Malware payload (Gafgyt)", "value": "e8a2e913f1ee8f7a560bc525807ed197b5a5238b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049843, "uuid": "406cf58c-b477-46e2-9f81-1c5536c10b97", "comment": "Malware payload (Gafgyt)", "value": "5b1a776a7365e7512d7499011756ac36fa9ec5153432c51c1433fe43983df78fe1508bf2e7d7b65b29c60951af877bd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049843, "uuid": "a897b6c5-6f7e-4993-bb08-f8b77c68b66f", "value": "T1C7058D13FB08A553D8564E316DBB07EAC370904201BAF2075A0EAB3D1793B75DADB399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049843, "uuid": "ab710a4d-ae94-48b7-b8ed-bfb799b3e801", "value": "12288:UstqVNfPOOkLaO6wgOSs9+WHA9PhUuKHRZ58Bv4XSdxb0NYTv8kfnRH4Rb2K9U+j:Cy0tZskv8C2AQUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049843, "uuid": "21da4cb4-0143-42be-a449-2d1dbddb57a8", "value": 842976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049843, "uuid": "b345da76-7fcb-4051-a78f-d3c36d239f4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049843, "uuid": "aff9406a-5e4d-4b35-8f79-86bad90f7009", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13536d1-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1765038630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038630, "uuid": "7cd1cdaf-08d8-4fc9-9e9c-0af73590797f", "comment": "Malware payload (DonutLoader)", "value": "78712a92a9c501daa73c25f7097f3e33", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038630, "uuid": "55190edf-391f-4d6c-bb2c-0e3c80cfa285", "comment": "Malware payload (DonutLoader)", "value": "857e377f50ad012a0ba740ad9b13e9af2a0c48c49a6e988b7279a69b6524cd69", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038630, "uuid": "3054e089-abdc-4745-8356-ce8b7d040132", "comment": "Malware payload (DonutLoader)", "value": "f904ba61ac9d4b8aaf6a83666dd119b9a9e921e9", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038630, "uuid": "42ebc9cc-5bcc-4eb4-b774-cd6b914fe073", "comment": "Malware payload (DonutLoader)", "value": "e2376a937e676b37d3416467e70d13970301613fe758f7bb6de799315a71c1df12368db0e753fa24a8d1038624f2f23d", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038630, "uuid": "e6908a77-4b73-4314-9f33-77cc0598e40d", "value": "T1A1F36C5773A820F9E077C17989920A06E372B87657619BEF03A0477A1F376D09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038630, "uuid": "90fa3d3a-4167-4b29-b4ff-03797e86a6c2", "value": "efeb5d2e785b956a774e5a38aa6509fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038630, "uuid": "4eb949ad-28b8-4ffa-b70c-5a2d572653ad", "value": "3072:rDNnXHDSLs+FF+gXWrzDwFakFRixQO/iH7H/1JSA:rDNXHD+zdAqaY7HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038630, "uuid": "b5d50a74-4933-4962-8cdf-f97e1b949292", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038630, "uuid": "45051cef-02eb-45f0-9d5d-7f74efdcf3fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038630, "uuid": "a2d27f79-d102-4a37-95eb-b48aecfa1b68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218f82d1-d251-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764990634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990634, "uuid": "7f48ecc7-adff-402a-b520-03719b5b8ef3", "comment": "Malware payload", "value": "8815453e0da67735902ae318a14888b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990634, "uuid": "fb216243-937a-4e53-b145-c9878f4133cf", "comment": "Malware payload", "value": "864b57bb719900bd2fcc8f3bccaa06412a604635497534d4d08db87b5da3efb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990634, "uuid": "3efc42a0-1b8b-44fe-bead-aabdf0d0fbec", "comment": "Malware payload", "value": "39c2d7acb3d8f0f4a8203b8ce40d0572249958ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990634, "uuid": "77d34cf4-1578-43bc-9a14-a9e3ba147479", "comment": "Malware payload", "value": "f75e84663db38a51eea06cf5a94bcab13fdb9537e798d51a930a86ca422c9eb7fa90860d61ca08f5a6edb813f4be0ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990634, "uuid": "f8153e9e-5705-4e06-9337-b2261f18fae1", "value": "T13E65AE1EF3EB8AEAC257963CDB917533A1E43C24172523D773819A1EAA965C0CEF0315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990634, "uuid": "b912e01c-e96d-46d5-a4b4-f9e12d05d439", "value": "17b3526ceb730d8841dade6e6fce105c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990634, "uuid": "0a2d8239-3c26-455e-a23b-ccfcc631cfc1", "value": "24576:b8gZbeEuCH1ye07DCnyntIf3QdBK1tyFDG4OIKkM2NWJRv:b8gx5FVye072nGHLOIY/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764990634, "uuid": "09f96533-eda7-4225-9c3d-f7a701b54324", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764990634, "uuid": "78b37121-c479-4780-82fb-929405097382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990634, "uuid": "efb623ad-6330-4dbe-9650-6cff086f808d", "value": "Hakai.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839d22a0-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002395, "uuid": "c4033501-8a76-4729-bb73-7b542f47a7f5", "comment": "Malware payload (Mirai)", "value": "79eafc4c2a9b08922fd172088841787a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002395, "uuid": "504e1d8e-e5e1-43de-be79-b05a5da45924", "comment": "Malware payload (Mirai)", "value": "86bcec5c8534b5ef536d3d368d4859547117a687a69e7f8413e90e916ffc3abb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002395, "uuid": "c018d91f-8ab3-4ab0-9294-bbb72af953e7", "comment": "Malware payload (Mirai)", "value": "8ca050cb42b87b1e334151ad03f450ef98c4ee45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002395, "uuid": "7cb20b1d-a695-44fb-b3ed-5cd1f128b9cd", "comment": "Malware payload (Mirai)", "value": "48c2d67f9e9d29d8e682b252121287811fbadfb6ba174d8a6b7d813d60aabe12a91288fe2a502f5eee42ef0b865f18d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002395, "uuid": "c6e4e550-d731-45d8-80f5-c2368a8df054", "value": "T1BDC32A45BC429A22C6C212B7FE6F018D372557E8E3EA3207CE255F7036CA95B0D2BB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002395, "uuid": "5656d48e-29d0-4b4f-ab9f-dc69a413a448", "value": "1536:YhxxuOoq0F69mNQk+TBtCsVhsvWLi61Y4lsxHnBeZdGVqYWt2PEvYOn4md86qclC:YhxUeMxYCHBwckYWt2s26X3kF+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002395, "uuid": "5f472006-bd34-4f0c-9507-35c2b40b0d64", "value": 128392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002395, "uuid": "b7e4e084-7c08-46f6-8eab-4c2d42075c28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002395, "uuid": "881ee8d3-8af0-4ff2-b52b-f1f67dbdda4f", "value": "colonna.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85d1ed6-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050158, "uuid": "af495f9d-0ab4-4136-9530-f1bef9c18289", "comment": "Malware payload (Mirai)", "value": "403b9f35c7015be00a27b4b9e757a37b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050158, "uuid": "d8b7730f-17a4-49fb-9c4f-db9decb38228", "comment": "Malware payload (Mirai)", "value": "8764412ba385530c9ef5648ef546834a0b3147806908c3b494bd49f3c8053276", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050158, "uuid": "d6bdbdd6-8241-4929-8d2b-3daa2a1a827a", "comment": "Malware payload (Mirai)", "value": "6ed008128a96a23b5ea8b74c8d4c67ea6572db19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050158, "uuid": "ae9bdf1e-f898-4e06-8e57-33b97f4bb909", "comment": "Malware payload (Mirai)", "value": "2451e50297cbe7545b86f7b6b1ae2eba0528f081911b5b88579b112589b894963827014075c72756d2bc4cfd9a3576a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050158, "uuid": "013b8898-6492-449d-ad26-1340861b45a2", "value": "T1B5B3C85E7E218F7DF7A8863047B34B21A35923D626E1D685E26CD9041F7038E245FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050158, "uuid": "18a49c82-c04d-4ed8-97fc-994b7ffe71af", "value": "1536:pTtgJlCSYhqbLLqDridBiYNVKCNrx39W/RGpYTKGNeRL1HDJ7ABkw:EJ8Ob6DIVKCNrx3qRG6LOt79w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050158, "uuid": "0caaf928-8716-461c-83af-3321995e2dc4", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050158, "uuid": "dc253858-8eb2-4e7a-9816-23d06572f746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050158, "uuid": "f2942311-3d00-4c36-8148-fe3b58c4bf3a", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2080c62c-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043460, "uuid": "07ace4a0-3d26-44d4-b7b2-2903bf61ce19", "comment": "Malware payload (Mirai)", "value": "49a9c7b6cd351c115f59d1021b0ed9b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043460, "uuid": "565862d2-7e15-4224-ae2f-6f9505b9b4fd", "comment": "Malware payload (Mirai)", "value": "877df054bb56d748db96839685b8130e134ca8fb28bd031da076ea5fb6bf74b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043460, "uuid": "ddcad1cd-d5eb-40e1-bd91-e8020cf0a15a", "comment": "Malware payload (Mirai)", "value": "9b207a8ffe544122a94de259ad788bdb83fa50c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043460, "uuid": "bc5b7d88-d982-4a68-adf9-daf5d282de95", "comment": "Malware payload (Mirai)", "value": "b9c9f922db60cd433ea060b5a3c73a7609b483f55b087e2d80fab4bd402adde90c30fef666e132f8802f92c20e72b98f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043460, "uuid": "7211cafe-ea8c-4b45-952d-908594142692", "value": "T13AF2E1B416154D8ED2D5AAFE1BEE8FA22EC90F7125417C92EA21A257C71747CB80F3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043460, "uuid": "3f7d9431-4b9e-49af-a9d0-857196c30d93", "value": "768:flWqYyhCLjzX4RcHhuDaxCfF3HsQs0drwLnXD7m5qkhpJgGlzDpbuR1JQw:8q+LIRpax2MQssqnXD7mqkVVJuew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043460, "uuid": "b7ad654a-dd24-457d-abd5-a4d3ad73a883", "value": 36120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043460, "uuid": "c5eb4e3b-00d2-42db-9763-9992c8f92402", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043460, "uuid": "b69b4765-21c3-4ee7-a825-577cd39e09cb", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cc06bd-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042214, "uuid": "dcb54232-316f-4f69-8b57-2dc7f70ef0db", "comment": "Malware payload (RustyStealer)", "value": "23f6cd4aa78a9cc6e85536acbed9b507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042214, "uuid": "8a27581e-5e12-4860-bb77-d997a86f36d2", "comment": "Malware payload (RustyStealer)", "value": "880aa543eedb98847e4345e024c9f1665e2c9df3c379ecc18d9763a46d05b47e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042214, "uuid": "d55cd10f-13e5-4fac-8d52-91b40eaed532", "comment": "Malware payload (RustyStealer)", "value": "5e9cda4862dd187019c01a42eff1c17566ca8f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042214, "uuid": "04a3600d-a3c1-4f5d-86a2-545770677b01", "comment": "Malware payload (RustyStealer)", "value": "16738a4765c139d50ee9edf7e83662a5aa34272515bd6c0ef78e200936b0d2da5eae185552372b2460b7758502bad525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042214, "uuid": "65400787-73c1-401d-9c4e-9bf613a8dc02", "value": "T114958D03F2A6D1EDC09EC1B443469A32BA7AB889162579FF06E15B312E65F510F0FB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042214, "uuid": "0d42f7ab-616d-45c8-82d3-2bed2b410824", "value": "2583461d88c56e13c224ccdd0e0d33ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042214, "uuid": "9aa3333a-3490-41ef-8376-f4771a90be24", "value": "49152:e2QC16k/gMfa5Um4RmOAGcCBTh7+9i8E2w:oMfa5Um4RrhQm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042214, "uuid": "ae71967d-9107-4362-a1a3-a807accabb28", "value": 1950208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042214, "uuid": "acf891ce-46a1-4d92-a883-9a58c134c465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042214, "uuid": "fbbe5d36-dc13-42e8-8c07-5f870828c9bb", "value": "fixed_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297869a8-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042187, "uuid": "6813192b-5c44-462e-8258-9b0459b6f4a4", "comment": "Malware payload (RustyStealer)", "value": "d480c0df2329b9edb75e450757817f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042187, "uuid": "68f5c04a-ee79-410a-86a4-ede22c53b2f6", "comment": "Malware payload (RustyStealer)", "value": "883fcdd333eb4252d6f254f9a5a7fb72afe9f8b9dc305e1739517d2493e00b6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042187, "uuid": "e2199852-e06b-470e-8b5f-bc3aa9a7478a", "comment": "Malware payload (RustyStealer)", "value": "403119fb6fb0e41c20e85555632a398d477f84b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042187, "uuid": "1030b4bf-7d10-44f6-b7a6-c4cc0851c8e9", "comment": "Malware payload (RustyStealer)", "value": "c56697664ea02bc2be0c288829ab10e02ad716fd950b9e6d0bf2000cb22b709d84b1a8cafaf87dc4dbfcf973b2344491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042187, "uuid": "67971ca9-5fe7-423f-a752-53c6cc8d881c", "value": "T1BCA56D03F3A581A9C1DEC1B98705A775BD7BB88D096076BF0AD34A303E69E944F1E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042187, "uuid": "61c9b88e-dee5-47a2-8dbe-470ec90eef58", "value": "5aff6c59906e71ba7f18f6b50812a6ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042187, "uuid": "4bbaa4d4-eb38-417c-ad5d-6468182edc78", "value": "49152:MGjP0ydCl6/xSe7J88HxzA+8kgMWRiBO58Eg:MGjPrJ88H9W8Bgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042187, "uuid": "e53d1e22-ce82-464b-be6b-6f2837827f64", "value": 2129408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042187, "uuid": "8bff14a1-403e-496b-bc19-b5bb98d174e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042187, "uuid": "b771e689-9d31-48d5-9447-e931ac6c0c1f", "value": "dec_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0b0938-d248-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764987110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987110, "uuid": "615ef1b2-7bc1-4576-b0cc-aa62e94fc34c", "comment": "Malware payload (CoinMiner)", "value": "5bc89f19482e7ff8b82fa898f5e91207", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987110, "uuid": "ccd2aa9a-e299-4cd6-a219-3d9c8ca11324", "comment": "Malware payload (CoinMiner)", "value": "894bde348e881b4e89887f1c55cfb21f13e47d7819d2e207ab60712175b66c29", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987110, "uuid": "690e4a9e-a4b3-46a6-8df9-ada35b925fe2", "comment": "Malware payload (CoinMiner)", "value": "aff376042d3d2a5eb4d87dc0ffe9545607a6c4f2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987110, "uuid": "e03bcd65-139a-459d-a3b8-5bf238385143", "comment": "Malware payload (CoinMiner)", "value": "ddfc075048e1b36add11597e11e130c799095679973989597cfd6f0fd179f3e137232f09d2bc216c2bc909dd30040ada", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987110, "uuid": "39630159-6af5-46cd-a17d-1a0be4fca684", "value": "T1971123CAE0A1DC70395C44ACF6875012760A8F9B04C58C44B81F367A3F54229F53877B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987110, "uuid": "0c50fba2-e712-4bfe-b64b-9dd736141f40", "value": "24:yGyZ1rFy/iKbpJnHOjWIEQXi/rvsTI1Xnn:yGc1GH6EC8Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764987110, "uuid": "f9af5f02-ab69-4bf6-808d-059f255703c5", "value": 978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764987110, "uuid": "821cdc0d-9de2-423c-aab9-d1095ac56423", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987110, "uuid": "1d998b83-0691-43af-8e0a-b09af1736e85", "value": "bolts", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc137798-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050164, "uuid": "b2d5ef68-d67f-4cff-83e0-45694c8bbd02", "comment": "Malware payload (Mirai)", "value": "7673a9fce48c2f618dad90b9ee5314e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050164, "uuid": "7d102805-65ec-49ce-bd46-97b5a940e7e7", "comment": "Malware payload (Mirai)", "value": "898ab52480f23e266d8a7b09ec97f207c7764ada1f834cc75d4f2d4061b33df0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050164, "uuid": "d65541d2-6c01-41a4-a973-517e568183f9", "comment": "Malware payload (Mirai)", "value": "60448c7dc6ff4b103fe3cba13db6cd7dc83b9a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050164, "uuid": "aa72d31a-7ff8-45f1-a52f-300d0e83acc6", "comment": "Malware payload (Mirai)", "value": "7356b9e2e10e78834f1e32f238c9e5ae08a4a73e7ff9ed53ec04a552646c318c188d34bda16c576765d433e3daecb76d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050164, "uuid": "e7bba367-3ca1-4572-a2c5-613de4c266ab", "value": "T188736BC2B743D0F1E9660632217BFB364633E13E0029DA43D7A9D87AEC52641E6663DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050164, "uuid": "682b53b4-06f0-4366-9885-8f6368214949", "value": "1536:+lBYOT1n4SLczH/6Oz1kU6s5oG3fs8kZ2rEZsS4W0Si9LmBx:+BN4SYD6U76AoG3ELZKgt6LmBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050164, "uuid": "91f67fb1-0b11-4d8b-b2f8-911e603f6a1f", "value": 80208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050164, "uuid": "2310e46d-4670-4e0b-96a3-95599c01ee10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050164, "uuid": "38a264d7-fe43-4b34-afde-6ce739ab7b50", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e954009f-d25b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764995264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995264, "uuid": "19d922ae-4f76-4820-b2cc-2e26bdc2651f", "comment": "Malware payload", "value": "d1469e9dab67e291e7572ded304aaa4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995264, "uuid": "6cd4cabb-a7e2-4741-831b-199c58b2de96", "comment": "Malware payload", "value": "8a5083145b33b86d676773342ef9aee5f3e3295e7fc1cec7da4b4649ce2a6c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995264, "uuid": "8e511d48-f810-4361-8613-ac2a263c1613", "comment": "Malware payload", "value": "edcac3539dc4fab298c33032ec872599cfc27061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764995264, "uuid": "45f383a5-7826-4475-b713-7b686ee2a9af", "comment": "Malware payload", "value": "86fb94f0c34075bc08590d5ffa1ebb7591c61e455766ea114e7edaf306f2c7e27772f7994a09d1359c775586443fd170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995264, "uuid": "43bd5b0e-6902-4006-a0ef-120f048129e9", "value": "T10081CD09D20B69F2CE4508B229CBE9AF9F307A74D871CD11FB609E61BB43C2D5644F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995264, "uuid": "ea82fe2d-1985-4d91-8533-acd8cac5aa38", "value": "48:6lpeVf6foV1lFk/Ek3bZHMaZGWD3abyNfbqUN6icRaL1dHx0r8T6GPgIkSwjb1Cq:Cwf6foVqsk3b8Jf5RaL1dRmGgh8wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764995264, "uuid": "ceb108d0-aa9c-4688-b417-4e8d49688ab9", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764995264, "uuid": "c82ccb1d-53fb-48f8-a033-d6e08ab80837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764995264, "uuid": "f7f12c86-76e9-4600-b004-bc2dd11a673d", "value": "SecuriteInfo.com.Trojan.DownLoad3.40744.18753.15683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d97127-d2d2-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1765046107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765046107, "uuid": "05691e72-f05a-450d-8e29-5575243bac94", "comment": "Malware payload (ValleyRAT)", "value": "14150e2f992ba4a74b43d34be784225b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765046107, "uuid": "7b19afa2-4597-4486-9d80-2284a1159837", "comment": "Malware payload (ValleyRAT)", "value": "8a867de9d0495da543e88de03798dcc7e5e7aa460ce2ecd27a498278840f9d48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765046107, "uuid": "4e9244a7-6282-447d-96b0-7a0e51641bb8", "comment": "Malware payload (ValleyRAT)", "value": "129d83f226bf83916b928c059d918edcb92c127a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765046107, "uuid": "d82c840a-3750-4942-966f-a7bfc486bb32", "comment": "Malware payload (ValleyRAT)", "value": "a48bdcdf938a11f77bb5c36d34300f8237189089fe638d20af1d5fa0570118d1473ace0c4bada43252474af34109d8cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765046107, "uuid": "29aa1966-2f80-454f-ad3b-cee7940b2040", "value": "T1FD45D242559878B9C8B72572377A46FC9738D8518670CC7BA2D00BDBFEAA1527233387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765046107, "uuid": "fce79831-2838-4197-97ba-373f4281eb90", "value": "fa49881c68b6479988303adea847bda2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765046107, "uuid": "dbdfd78e-5a5c-443e-99c2-91b6632de996", "value": "24576:B/wj7MOxYp1Fyq5c95IawquQ+IaluTUkNDwW22RoKatMR0Gi2xi:xLOxaggZ0aIDTHWWzRoKatEL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765046107, "uuid": "c12f7fc8-0614-442f-b15e-e81ee1e6e1b4", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765046107, "uuid": "b373720a-072a-4076-a1c0-df54db6d78af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765046107, "uuid": "34b84324-7c99-47fc-9541-709fd1681745", "value": "14150e2f992ba4a74b43d34be784225b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4128762-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033910, "uuid": "6f4ea10e-7cb6-40a7-be69-765d5108060f", "comment": "Malware payload (Mirai)", "value": "b244a9f52845c45c9027429e49042368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033910, "uuid": "565a951a-a23d-415e-80cc-94ffd5e9f9a9", "comment": "Malware payload (Mirai)", "value": "8ae183bec69f8243bb132313b550584895284dd88df42e4e19f2d7c5ddfe4064", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033910, "uuid": "72b2b91a-89df-4420-9593-069aa0f79e74", "comment": "Malware payload (Mirai)", "value": "c31a671b95a6ff0d80eccdd4de9ed878621c1b0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033910, "uuid": "6e3730e1-3328-4884-8ce4-de2e2b3cb3e7", "comment": "Malware payload (Mirai)", "value": "c993f2be1b6829e666427e6f49bed0f7740d83f1a13fe363d38c23417cab1723b41e25f1c7a7ec8313ca764f280725b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033910, "uuid": "dd3b7feb-6213-4183-a5c3-52d1b213e0b9", "value": "T19063754E2E329FBCFFAC463487B39E215645339626E1C585E1ACEA011E7034D345FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033910, "uuid": "0d05cfba-790c-4258-9584-f75ddceecb57", "value": "768:2QbnZz+D0GvXIdoy9l8wMrOZe3JLbwWehGXAZZaCAkdX9yYgFdPOZYj/rFUE:LbnZ4nyZ4wMryiehcAZZaa2bPOZYtUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033910, "uuid": "b2484aec-d1a1-49b8-a217-0739387bd4ee", "value": 67744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033910, "uuid": "0af96246-f4d0-4f53-9063-e942c3f57878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033910, "uuid": "027330df-a171-4a59-a5a9-b173911c9c47", "value": "b3astmode.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d71f5f7-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050059, "uuid": "640f447f-492f-4fea-b0fa-bfde27f5cd08", "comment": "Malware payload (Mirai)", "value": "950096192dcd7934566ad65dd09af192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050059, "uuid": "d849ba9d-4c85-49ae-90c2-d0d6e313070d", "comment": "Malware payload (Mirai)", "value": "8b40ce04524582dc1287b362841198d83d9cb504a54e3e6c3ac34fdacc9329b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050059, "uuid": "443c8a87-097e-4c42-8ffd-a902550d0f22", "comment": "Malware payload (Mirai)", "value": "61b8f9acafbf8a62b68e818ab8494acd66b27918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050059, "uuid": "a087d30f-f30d-438c-92a0-fb7d56da2693", "comment": "Malware payload (Mirai)", "value": "76b3ae86dfdbff0f6fdf4dc0c11e35e092bac097d0bcb3bf3d0a42eb323493c56c266748ccf3d2bb945dcb786362ce77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050059, "uuid": "35cb850b-4629-4fd8-a670-ab80a395b94c", "value": "T1B813E1B502A62478C428CA7DC46E5300ED77083661E36B5F427376AFACE358F3634AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050059, "uuid": "2319d53e-dad4-4bdd-bd7b-d73015166676", "value": "768:2q6H1Y2jiF1D/2hsOjH/1pDrKYT46e0l4ZA8VslyIpxx07q2:YVNq2hsOjH9thT46xl0V2/HOq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050059, "uuid": "3062da44-7080-42af-a613-fb63009e3bb3", "value": 41916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050059, "uuid": "d7b95591-66d2-409b-bca7-19b7f14a8610", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050059, "uuid": "bd6693bc-1c2f-40d6-9114-ba0d8cd44e11", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8341f917-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765050069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050069, "uuid": "daf7aca5-f0fa-45ef-984c-3d2e08c6e493", "comment": "Malware payload", "value": "2f43e3ed916134d9e7de4f2fb7dd88fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050069, "uuid": "3d9bfb32-6369-4ae6-9ce0-d6473adfd1ca", "comment": "Malware payload", "value": "8bc9347242ec4feb6f8de066e52867df7db691346a63a52f2a9f7af5930617dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050069, "uuid": "c3061596-5634-44cb-a528-d0570fe52084", "comment": "Malware payload", "value": "414b4b5c9fdee4a03faeb027d5914fd980abe607", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050069, "uuid": "37f21432-4714-4a64-bce5-8b97620c7379", "comment": "Malware payload", "value": "6daa0c5d0ce71e60b7322e2e618c3c17f58fafcb61ec0b010fe97fdf35743dbe1bb6d66874e1abf659bd1193da4e07c5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050069, "uuid": "622fcae5-83cf-4cdc-853b-a1ec5f1c481e", "value": "T15001929E1633548B41199C5AB3931E60E8909F8D31DA8BE8BC8C427484CE59D717DFD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050069, "uuid": "9a3ba7ff-cbc4-436b-9c5d-5d70dabc13ce", "value": "12:uO3Slz3AJOKOhlzK/FFwO4lzlLi/QlTU9NW/tgxzjxF4wu1pJLK8/NlMI:uQAAJXcc/hvW2JF4tFP/gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050069, "uuid": "e312c704-1cce-48b1-bfb1-53c466a88dea", "value": 766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050069, "uuid": "d707a432-b5bf-4a28-bd75-cb4e9c1fff4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050069, "uuid": "68afdac0-44b1-4f0a-bd79-808f3f9c8066", "value": "fent.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6601f8-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765050139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050139, "uuid": "bd04f759-5f1e-4016-af64-e0d4b8eecd7f", "comment": "Malware payload", "value": "a4d79e2e4e2cf3b4c6fc55854a42bc3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050139, "uuid": "1e57a1aa-5b91-42af-8311-828b9a2b5429", "comment": "Malware payload", "value": "8c3071f3e2a58661b2fe907cf502b1ae67a7d15c19a40d57ace7f6499a5a42ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050139, "uuid": "74cf74ea-76b3-47c2-a997-c1cb61ace2f5", "comment": "Malware payload", "value": "b18a1668bbba60761a808fab609b78c385915f32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050139, "uuid": "24f3264a-d8d5-4492-87c7-c43c2504ee46", "comment": "Malware payload", "value": "715b1fb70762374f27079d1400a25539daad4eb853bc5e3adfe75f083e1b5947efbda59faa16f26019e0644d81cc9cbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050139, "uuid": "866712c3-594e-4a23-b80b-c523eb369318", "value": "T117934D02B31C0A47E1571EF02A3F27D1D3EEAEA020F4F6C5691EBA4591B5E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050139, "uuid": "1395af46-180f-40c1-8666-7226a14feacc", "value": "1536:hdTMIS5WAfT7ur3d2O2SivEnqVsOaxN+sdDJZnZKa86FgmYeZrvxmC:hdhZsTSqYNXbZE68y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050139, "uuid": "89d5ecb4-135f-43f5-8b99-8bb1cb725139", "value": 89440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050139, "uuid": "cd70f8d0-8f12-4869-bd0b-9530635e4b2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050139, "uuid": "ac333037-9beb-4954-9900-7291293f748e", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e084dc-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002405, "uuid": "bc807871-1a7c-4a60-86c8-4f6f44fcde45", "comment": "Malware payload (Mirai)", "value": "ddc26e3f39399986e4ca31df8a8a227d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002405, "uuid": "51d3330a-8277-4119-adea-c14774e4a2ae", "comment": "Malware payload (Mirai)", "value": "8c5799469e5d786e6433c271e694513b09e4ab5f3c5068e76e741336ccd957b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002405, "uuid": "ff0e7e6b-f38f-4529-a583-7952760a67b8", "comment": "Malware payload (Mirai)", "value": "f0c2ad7a1cdd71ac4ae7ba6b6ecb0189b1e5acf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002405, "uuid": "0d9e3637-bf9f-4c89-8e74-5ceae48c25dd", "comment": "Malware payload (Mirai)", "value": "a5d17d97acf5fb1d8485d3585cccccad7827b4d1a16d432966753242de0401b2387ffdb18fb028eb250c104bf81e2304", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002405, "uuid": "f932de7e-f8af-4d2e-a8a5-ebb2ea9b96f5", "value": "T193C35A25BA7A1A17C0D6B57E12F74311F1E2638921B8C60E7DB10F8EEF547803457ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002405, "uuid": "5232f38e-297b-4c40-9fa2-efe9fb90f75e", "value": "1536:5dwww7fNm2+btThAUTTJ5kljDSuqaP6Iq+0sBYzmF5t6ztg1c2OtkkivbKjA5Up+:HtFwljOKSN6BYzm3tT1qKkO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002405, "uuid": "ec655e62-e653-45b7-9388-611a3ebcb178", "value": 129484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002405, "uuid": "b3ebe440-b8d1-4ae8-909a-ef837ea28db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002405, "uuid": "e385e520-9c8c-4a43-9ebd-80f6aa395d22", "value": "colonna.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da66e49-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002412, "uuid": "dc143925-08a1-4555-a0b5-54e1f52049f5", "comment": "Malware payload (Mirai)", "value": "93641b574966edf2a40bb153bff8e80e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002412, "uuid": "0fb50345-0213-4dfe-bcd8-81345c7fd235", "comment": "Malware payload (Mirai)", "value": "8ce19399addb607be63f6943cac604ece563a97b0bad1bd75349124775a94039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002412, "uuid": "0cb8bcb8-000e-4c79-9e28-36659cabfe28", "comment": "Malware payload (Mirai)", "value": "638927777c5cfde18f26f6df45c2d36e81082062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002412, "uuid": "94c77fcd-fa30-4e96-81a0-e967b69052d7", "comment": "Malware payload (Mirai)", "value": "708340af173459ffa0fabc4c5ed5b839aedd2247ddf0676b0f4a31e23be19690add1b0aa06f1fd547379a7097ce59291", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002412, "uuid": "f0e066af-66ea-4c4d-9d81-1752d584ce97", "value": "T186B35C07F58141FDC08AD1341AAF7637D822F5AD2234B69777C4BF263D5EE205A1AE28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002412, "uuid": "e6400967-2991-4cb7-8688-ff81175558c0", "value": "3072:fIQi3XmGTO8XRJ9KfbVEBho3AJEBM9quvNKLjoyN:3i3XmGTOsRcKq/BhsNeVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002412, "uuid": "47522fad-f4fb-4cd0-ba16-9e174a948938", "value": 116648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002412, "uuid": "7ff77de5-4fa6-4683-a9f7-3feb28303624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002412, "uuid": "b4d5a45b-8f46-4f73-880e-19f8298c7892", "value": "colonna.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee95c98-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061201, "uuid": "2ad65f92-f70e-4fb8-8ba3-2e87c5f5a50d", "comment": "Malware payload (Mirai)", "value": "c42267f4e51624a59e85600a5afc00d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061201, "uuid": "d5cf9a10-ecef-4e8c-9ffa-70eadbf1a512", "comment": "Malware payload (Mirai)", "value": "8d3e28443656b7f48f0e93860ef4cc2fff2d26655b3111471848b31c4754b607", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061201, "uuid": "7ef5f033-fd42-4fa7-8f4f-2f935460d149", "comment": "Malware payload (Mirai)", "value": "06400bfaa834ba8132c9cc4f7c255a4c3a934b69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061201, "uuid": "7cde64f2-64ca-443b-9a4d-20edba9bf8bf", "comment": "Malware payload (Mirai)", "value": "7dbe2d8274784bd625986682d4db6a87d276064866e28ca4812c53dd1cc2c5001c12d51a0bbd84c38b91199e950968e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061201, "uuid": "4c4bb2d6-8f44-40c1-b709-ade87c5505c4", "value": "T1CA82C0314621BD11C3709C36D4BD8787A58A06BED1FD326F9621427DF5C0AC664B97C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061201, "uuid": "302b67fd-bea6-44aa-8d07-b929a699dd0d", "value": "384:Yz2iQCAedWyxQsIkfINC+uwB9K6MwLX53BPnFohymdGUop5hV8:YqiJAv8i+IVHrhT7Pys3UozI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061201, "uuid": "a2488e6f-f96e-4cc2-bd9c-66db960f8246", "value": 18344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061201, "uuid": "b390ec63-4820-4c7f-84c6-44b8cdea5ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061201, "uuid": "878b8548-8d63-42ee-a145-ca7000d10536", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3ece30-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765012016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765012016, "uuid": "7e97c5f3-0262-4c8f-99c7-6c84acd80122", "comment": "Malware payload (Mirai)", "value": "877b3415dee71e5f473851cd48c684ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765012016, "uuid": "cb3d1275-f9ee-4710-9509-3082d46196c6", "comment": "Malware payload (Mirai)", "value": "8de897a70f61b2b8d347a31adf154a80415ec03a75b3350acc2c90fb27975798", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765012016, "uuid": "fbb2f524-07f2-4892-ba1f-259dbe9c682a", "comment": "Malware payload (Mirai)", "value": "4f7d23c72a7e45f499cc4d0f64bee54b55fde4b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765012016, "uuid": "28488458-7258-4973-9981-01a75a3a506b", "comment": "Malware payload (Mirai)", "value": "b0ec80aaeefe8a5df695231b3b56b7018fc9c049d2b0167b1b278c18189eed21be4a5af69bfe993c4fb91e0e4bb42e33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765012016, "uuid": "9055c58d-85e7-4d32-ad03-c76138357681", "value": "T1FF559D48E783D8B1F59305F00E8FD3F325206B2A8057A6F2EB8D5A6674777532E5A318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765012016, "uuid": "fcecd1a8-b2cd-4c1c-b46e-522fb3c0aa75", "value": "24576:KkAKAO5iEAljjOgtgWozMbhehhCU8UFvJxt0Pq65TtkAJkKdR6oWxGMx6XTaF:JAmHMbhehhCcY9Tt3BjWnx6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765012016, "uuid": "fb9a07e7-d38b-47f9-a091-38c04925ec3d", "value": 1371144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765012016, "uuid": "763dd62a-fb36-47d6-9072-83e8f526c088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765012016, "uuid": "87f63dbf-7fa8-45e6-acd4-61e5119cbf0b", "value": "nginx1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba07fa5a-d265-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764999480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764999480, "uuid": "366b1507-23a7-4eea-85b3-4217bd2fe761", "comment": "Malware payload (Mirai)", "value": "2b676d06139591ddce23932ba8f9de24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764999480, "uuid": "7364b2af-27a8-4a40-bac2-641922bfddad", "comment": "Malware payload (Mirai)", "value": "8f1eb7c98c91b4a7154e6f2eef73287e114ade121140a40bfde3a1ab5ad19f87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764999480, "uuid": "0528f295-4aaf-4d73-bed4-d1b7dd077c91", "comment": "Malware payload (Mirai)", "value": "52da2dac225a5199e5cb0a5f7ede89b682c335be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764999480, "uuid": "4111994b-9575-48fc-869a-390db1e2f8f0", "comment": "Malware payload (Mirai)", "value": "72a62bbee052a2e4cdea7599c6065d570bf2154319eba7861f928caa78c07c13ed794086ffaa670c1e15a7c2f523f33e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764999480, "uuid": "9e5e6827-4c39-4136-bf6e-998e2fe42ed5", "value": "T1BA836C55BC919A12CAC152BBFF1F428C372613E9D2EA3203FD155B6D378B96A0E3B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764999480, "uuid": "f2e9026f-0080-455c-a1c7-59eaf8aebd59", "value": "1536:jghbn1RrjYvohsPERLSie0GCOEvnDCajuvEEqGvRk0EmS1c:GRDsMRGie0/CajxWRlE7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764999480, "uuid": "dc6851a8-eef7-4a7a-97d8-12bc3fb0c065", "value": 83392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764999480, "uuid": "021432a5-fe85-405d-9de5-dd05c791325b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764999480, "uuid": "9e2b86b1-6f9d-4926-8715-5f814c38f17f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cf69b3-d2e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765052088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765052088, "uuid": "3db7b31a-1416-4b8d-8ae7-80dc39eef165", "comment": "Malware payload", "value": "b71b846e19a02dd7da25ca92366099c2", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765052088, "uuid": "c16626a7-5cb1-42ea-8256-5fce3e23adc4", "comment": "Malware payload", "value": "8fa6ac085aa456f90237f65b1c8f314c2a3dfa6f871b03d06e11fc2e5d2d12b2", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765052088, "uuid": "344b60ed-8fb2-4277-9e01-bc92a47723df", "comment": "Malware payload", "value": "7ba0d5e8a74955d590162a725b070427cc014919", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765052088, "uuid": "3b0fa85a-927a-4286-b294-dcdbb301d159", "comment": "Malware payload", "value": "e2e2ad5f77bbfc4b1863586cadfca4b7b7384ce169927c1efa9a2627fae562f213d015cef4f31b5ed4bf041a012de92a", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765052088, "uuid": "049bb914-57a2-4f39-9be6-5650074d1d9f", "value": "T1DD247D21B4C1C431D577153309F8DFBA5B3DB9211B626ADB67980F7E8F201C2AB3196A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765052088, "uuid": "08d8ec8c-73e8-4ea7-bbee-968fa3e93701", "value": "31ba2dcb49ab5d61acfa8dae6ea3c66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765052088, "uuid": "6bf89d4d-b6ed-44e7-a3d7-a700f5e5e0b6", "value": "3072:J9VXUi/M2MjjGnzOy8YU9PIQjGg+nHWulKJAvnZGnp0nGunADb8Hvgvp3mjxM878:WqSYU9gQVK/GAvnYnOUooIjlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765052088, "uuid": "c2fee900-a7e8-4597-8a21-13ce7c8d25da", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765052088, "uuid": "9e3a5c3f-d522-4c12-bf1e-612406e24029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765052088, "uuid": "47c402de-29cb-4575-b8a2-f2375938beb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc02ff50-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049842, "uuid": "44b1b6a4-f303-47e1-81b6-f8d33df1cfed", "comment": "Malware payload (Mirai)", "value": "af637eb80e8fbb2a8c91f6c65cc8e33d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049842, "uuid": "63ae78ba-fa52-4db6-9466-4b89416b3b1e", "comment": "Malware payload (Mirai)", "value": "90a7629cd7955a1d6c24f86a882dedd38c1193b88f8dbb030b3d6413b55c8e89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049842, "uuid": "2de59c95-e7dd-4185-abaa-8e8e48897e9f", "comment": "Malware payload (Mirai)", "value": "f226a296bafa41fd83b1b44ef2dfc731e20698f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049842, "uuid": "551e7e57-a54e-4c58-8b33-356ab5c4e90d", "comment": "Malware payload (Mirai)", "value": "5a2da23e27fda0a037d90cd62c201cb3136217958ec2739e5fef9dbef531b88abcb6a427fc9311f675e68e3474d427ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049842, "uuid": "c3f6f2be-8600-4164-8b3b-6418a330d3e4", "value": "T1FA059D1AFA31D432D47181774ACFC7B29234E036128B8257BF5B8D38B55A7A09B4F369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049842, "uuid": "2dbed65d-9c82-4c8a-928e-9e84ed87c8fd", "value": "24576:mPThkxh9JMMRv60+8S5bLGQSup0acqpQb9sse22/mx:2hkxhM52QHS5qp49sse22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049842, "uuid": "e441efa5-576b-4743-bceb-689be4e62637", "value": 870700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049842, "uuid": "c38fa53a-76eb-448d-a34a-fbaacefcbc5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049842, "uuid": "8c809b3f-7af0-443a-b399-a758d7f1dd7c", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba84d8e-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042244, "uuid": "709b033b-5e4a-4f28-8623-63f44e074451", "comment": "Malware payload (RustyStealer)", "value": "a16ba61114fa5a40afce54459bbff21e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042244, "uuid": "3326bb86-74f7-4768-97a6-b8e230015510", "comment": "Malware payload (RustyStealer)", "value": "90d223b70448d68f7f48397df6a9e57de3a6b389d5d8dc0896be633ca95720f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042244, "uuid": "1975a4b2-14ea-458a-a319-6ef3403d5f11", "comment": "Malware payload (RustyStealer)", "value": "2c01cefba27c4d3fcb3b450cb8e625e89bc54363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042244, "uuid": "4c25c7b2-9b04-48a2-b60d-4534855f427b", "comment": "Malware payload (RustyStealer)", "value": "cfb56db9d116bccdc1259936184a4c5b7d35cab324a659f1f1bb3530881f60a691ea355ea7594cb947520c46470e9f3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042244, "uuid": "8ea10ff7-da16-42eb-a4d2-19a632dc637c", "value": "T1BF957D03F2A2D1EDD09EC1B443469A32BA7A7889162579FF06E15B302E66F514F0FB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042244, "uuid": "494762ec-3dfe-4af6-9466-a6807667d56d", "value": "52517bc09e2d6429944f1d84ef2af633", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042244, "uuid": "0b3a55f1-72f6-4d3a-9a03-cdd86ead2468", "value": "49152:HCCC6V5tfKXCVfGYxDLtFxBcGAD9B8v7:9fKXCVfGYxwGEA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042244, "uuid": "08d0e583-9f64-42b4-8da2-deb166d60dd1", "value": 1952256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042244, "uuid": "57552058-62bb-44e5-a6a9-db74d0c59409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042244, "uuid": "c8f8f915-c1ea-429c-aab7-b758d86d0fa9", "value": "new_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfddcbe-d2b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765034972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034972, "uuid": "3de21728-fdc3-4862-b5e5-32cc0d9adc2c", "comment": "Malware payload", "value": "60e0a1708dc068c89984c798f2a2a71e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034972, "uuid": "359cfc8f-fca7-4c91-b6fc-fc25d421faec", "comment": "Malware payload", "value": "914ebc28c270eeeada23da31fd6554acdc91322c1478feb19d0c5e0c0ef2562e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034972, "uuid": "a12f2786-c377-4f50-b653-4e1db5839b68", "comment": "Malware payload", "value": "a9871c8c45193f6f7ecc5d8c892c6deea63ad49c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034972, "uuid": "e4c3a654-ff6f-4aaf-bae2-7c0ffd8352c4", "comment": "Malware payload", "value": "286e6efe4935a6b5b216b753793589d0a1e1f1669440312d15300c3e9cf848142065ec7b96a8c72c1bd0609e5fe3c7a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034972, "uuid": "5b48ba31-bdf3-4527-af45-05dfb16b1e0f", "value": "T15194E732B4C8D5A4F187D8B21C15D996CE1379438FF2294B77CA7F5E072A0580EE369A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034972, "uuid": "d2dffbfb-7865-4d17-b274-674311d88ee2", "value": "2ac29b9a5552466e33223f8c3f0a9886", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034972, "uuid": "36b602ac-9336-45d1-9cc5-988103354e4e", "value": "6144:f16Zc7rYXqR4mdO3Dt4a6/ePsDj3B/GvU7ke3GVFx:f16cHrimWDt4pDj3B/PQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765034972, "uuid": "3b774c7d-7239-40df-9d6f-c1ab0d5b43fa", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765034972, "uuid": "26546e32-ccd9-42f3-812d-c5e2e3af5447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034972, "uuid": "6f17c0a8-d8e3-4b4a-aa27-dba47bd1baf8", "value": "zh.bin_1757427233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e236a301-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033907, "uuid": "a4c5f985-e227-464f-be4a-faa17e2eed6a", "comment": "Malware payload (Mirai)", "value": "393f2c04489c5037ce7d42b250eb9801", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033907, "uuid": "ef324339-86bc-4ed5-b748-6920f362f1af", "comment": "Malware payload (Mirai)", "value": "920dfeb016244225a8aa4ba44315d65bfd5d4c8c2f96df11b65512e05220eaf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033907, "uuid": "ccc6d476-bcfa-45ed-ac22-824316903095", "comment": "Malware payload (Mirai)", "value": "4966af51c011e8a9a62bbe68318048a9c8fc9f1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033907, "uuid": "0d16d775-1bc3-47a0-b985-91e69950278c", "comment": "Malware payload (Mirai)", "value": "d10f3e944ea02cffc97fa2689e344f3b62064f6153d83a5484a6d7789a7cf9d6770a5cd8392e1f38c63de5515b340afa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033907, "uuid": "1d825641-9070-4e10-8856-9e3dfbb8c527", "value": "T1CEC32A46EB408F03C4D61779BAEF424933239764E3DB730689189FB83F86B6A4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033907, "uuid": "3e804a2b-02ed-4ee1-a0fb-1ab3fcf8ea12", "value": "3072:vD7gicgQrMpCP4dujryRgHGNkDa50TKJov+uUkELfAoGRfi73jLfDfmM/9oYtj:vD7gOQrMpCP4dujryRgHGNkDa50TKJoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033907, "uuid": "edacd9a6-7efa-4fb0-9d50-1211c4e70143", "value": 123009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033907, "uuid": "972e36f8-e8ba-4c5d-9aa6-ed3fb57e7c08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033907, "uuid": "fea51fd8-5909-4545-855c-93e7c95d7565", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47744136-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042237, "uuid": "f31f3d08-f485-4e24-91e9-4e82b0a455e8", "comment": "Malware payload", "value": "fbccc290103401149b65e7a936eb6043", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042237, "uuid": "e5220e60-d79a-4d5a-b626-38503e616ba3", "comment": "Malware payload", "value": "9283570c0ad823a6dba85d640d2fdddf4a0da091ec2f063ec5bc4cdac50d84d1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042237, "uuid": "9bf40441-a8cb-4cfc-a435-8206fb4e7022", "comment": "Malware payload", "value": "e68811249739101f555aa0311774f5c57b1d221c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042237, "uuid": "62b17207-10e3-4cd6-888f-a3ad73f2f1df", "comment": "Malware payload", "value": "633aa1f278a043358f3ca1a9158585a05766897adf1f3722e18a2eacc5034dbb344fbbc42f74c2f4645ad733f96b1a84", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042237, "uuid": "760da49e-d6c1-45f1-9f2a-473e8c907db2", "value": "T1E0A47C16B7A05668D46BC074C35796A2BB71B8992720BBBF03D092742F56FE21F6C70C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042237, "uuid": "9ddf221d-0f11-4703-af6c-b93c74b87ef0", "value": "fcdd976a24be670f3c5d7696a5f606d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042237, "uuid": "64c31b2a-df52-4f6c-8781-f51d6a179406", "value": "6144:ZA0r1uPb7S2/+xlSdsNR+P2c4SStxsEVqachGZiZxgdgpSzGvrLBeA:IMs2cPQx3VboaK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042237, "uuid": "3b550291-2b29-4af6-86e4-0d46050da049", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042237, "uuid": "ba363647-8335-4098-ab5b-15c34810a3e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042237, "uuid": "b66688a0-af3d-4a61-8d17-9e247fd6db1d", "value": "nethost_aggressive.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbd1037-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042166, "uuid": "f78ca142-c235-49c7-9375-0fbfc991e1f1", "comment": "Malware payload", "value": "bc376c951eacb36bf0909a43588e6444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042166, "uuid": "f74c7d65-2c9e-4183-97a8-8bf107564962", "comment": "Malware payload", "value": "92c4f4b7748f23d6dcd5af43595f34e4bb8e284a85d2c1647b189c1bb59a784a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042166, "uuid": "a6f3b9d9-cf96-45dc-8cce-e571c9ee4aaf", "comment": "Malware payload", "value": "78c8ab4a9932805f5fb32f4a19367642ea8ac6f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042166, "uuid": "55541e6e-4da5-4723-b303-f82af0fb53b3", "comment": "Malware payload", "value": "4169160b7e85051fba2c190a39330b9c9316dcae8f58d735810d55758e989914d5d9bf3a61fc2ed16f5766730347c243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042166, "uuid": "3a62afa6-2b08-4c88-b4cc-fb56093ca83c", "value": "T1EF65121EEBA401FDE1B7D175CD124806EB327C4E47B1A68F239549962F336A09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042166, "uuid": "0bdfdee3-04f1-418a-a1e1-3a1016e85f78", "value": "6ff084ea6e09e3ebcc767351ce4ecec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042166, "uuid": "982b2405-a0f7-4039-bf5b-e175db1993a1", "value": "24576:OpZYLCDHXBE2g+PcgIv9IPryj1KmD9ofTKTRVyrq2SzjEnxL8:K52AkgIv1vD+fOTRomvEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042166, "uuid": "d6c40fc6-49da-41af-a1b5-7c74444eedc4", "value": 1463808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042166, "uuid": "1398ec61-df45-4843-ab91-a57ab7180626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042166, "uuid": "5e7dcf2d-8eb0-416c-90ed-56f73d7982f3", "value": "chromelevator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b9ae4a-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043493, "uuid": "24665c2d-d00c-4f99-bab1-790a2c02778f", "comment": "Malware payload (Mirai)", "value": "b9510c16d9d4aa65daf95c94d77670a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043493, "uuid": "a8814cbf-790c-42ac-ba9d-83912fbf608c", "comment": "Malware payload (Mirai)", "value": "92db700af734af799d2e3a8ab2986081c195b50d96df826f34dd7c0c617864c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043493, "uuid": "11e5014c-92c9-4a25-a968-95f65ddb4acf", "comment": "Malware payload (Mirai)", "value": "4182c86b4cb1746a31606e12d2c16ed4a5eeaef2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043493, "uuid": "9a3c53f8-1dbe-4140-af53-322f60205494", "comment": "Malware payload (Mirai)", "value": "475ee4afd8c51b3069aeee95c30af5370eb9719c9647c0419400aff575c5c25a409bcf95695aaf9c840a2768a63cebc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043493, "uuid": "109fc03e-4b8f-4cd1-bfb3-78f862bf460e", "value": "T13F633A81BD815A53C6D112BBFB6E01CE372613A8E3EE72079D266F21378781B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043493, "uuid": "32fa5da4-9103-4439-83e9-e7601676c25b", "value": "1536:g1NnhydU0LklPVMGMt+Zo82Op3GlO9NUVyZvXo:g1N0Yit+yHc74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043493, "uuid": "fd38f4f1-3b71-489e-ba61-feab863636dc", "value": 73348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043493, "uuid": "5afc3c6f-9b78-48e6-a38e-f830909760a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043493, "uuid": "5476afd5-73ba-46e6-8984-9038747f10eb", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b887a1-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042261, "uuid": "91b407d9-b172-4264-b911-77baa68f91c7", "comment": "Malware payload", "value": "f7ec3bc553c1739a6ee9754bac09e055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042261, "uuid": "54d8e231-3908-4b37-a7aa-7a0ec7b2258b", "comment": "Malware payload", "value": "934c1b89f285a542c6dc5effe2cf5eff303fe54d8d6722dd6d996220fe576b3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042261, "uuid": "6cad597b-bfd5-4c28-a034-750a8a109127", "comment": "Malware payload", "value": "60f4d64893f4fefe0847c88210d623b848fe3b3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042261, "uuid": "f125968d-16b9-4497-ae4f-e0c19573712b", "comment": "Malware payload", "value": "4f4f719d6163207a290e025d07ee822d6f177b36c7bf47b9c436c09737820bf53b8e9081285ee4beb0c42569dea331fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042261, "uuid": "84a039be-7250-4ce4-86e7-6d5421357649", "value": "T181259D1BF695A2BDD15AC074831A8A72B536B8CA02317DBF16E1D7303F96E610F1DB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042261, "uuid": "03e5bc3a-25ef-4aa5-bb57-4c300cdedcbb", "value": "fccc5bd98f1825173552d5d9ba852726", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042261, "uuid": "ef13f87e-26b2-4526-94e7-06d94478d4b0", "value": "12288:g8CJqQcWw6nSVsJvxNyWL7vvVNKud5pShxt3zrlI2i9yEjfo+E+ooooBooED8ZgP:gUhWYQRvVNKud54LZI2+j08ZY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042261, "uuid": "6d5ee7e8-567a-4e0c-9200-587bbc4f4fed", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042261, "uuid": "a12ebe3f-30b0-4467-b0a6-6c57d9073d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042261, "uuid": "2ef27ec4-08ee-456f-9b18-f4c80c61a07d", "value": "safe_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfc65f4-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042195, "uuid": "f1216184-4dd3-405a-b398-b43fa964c536", "comment": "Malware payload (RustyStealer)", "value": "f6b678886d38dda59678e5422697aaee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042195, "uuid": "d79309e2-4d2e-4589-b122-f79fffa962a2", "comment": "Malware payload (RustyStealer)", "value": "93c53ebc8d1ee19dad41cfb7989ed047136cd80669ec8ba7b0af4016f9123cc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042195, "uuid": "87c1a1bd-7107-4478-94fb-11806215f1a3", "comment": "Malware payload (RustyStealer)", "value": "ebad3ae916e075c119c1630f007e05fa5ce8cb6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042195, "uuid": "fbf8ae48-adb8-4195-ba07-e1952f532a73", "comment": "Malware payload (RustyStealer)", "value": "2bc4213e3df56fbe70c4accce5d5224cc87a5c3adb30e9ecce2db8a1dcc46698ff94363dc8bcd1ae9eeb9b0a0e5eae80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042195, "uuid": "48a6fa02-0fcf-454c-9372-7d3f245fb661", "value": "T127F6E8E859C858A1D257F83975997EF411323197EADF1E90C3BCF9610D7EAB2AE0090C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042195, "uuid": "d5d17c8e-d52d-47a8-b295-b79db3acf699", "value": "52517bc09e2d6429944f1d84ef2af633", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042195, "uuid": "06ac42a2-7da7-44e7-bbae-ef3c5ad801bd", "value": "49152:gKCs6ecLfyH365kGYx9k5jlR/zhxi9c8s0:qyX65kGYx2h+k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042195, "uuid": "532c2cc8-e8bc-49cd-acb8-3ba266b8d3ad", "value": 15801856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042195, "uuid": "27b6e5c6-6c81-43a2-a066-58253aa9aeec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042195, "uuid": "3a63672f-790c-406b-a6de-9b67e04898c4", "value": "enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d94d30a-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061199, "uuid": "52026729-9508-45a3-9f85-615280edd13c", "comment": "Malware payload (Mirai)", "value": "8457c3bca19cddefe6447182192fcc99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061199, "uuid": "db987e88-bf05-48ed-b986-9d1894cbcc78", "comment": "Malware payload (Mirai)", "value": "93d4e5a6f7e74123c34f870fe80bf83e49c947b1975bdf67ca387c144a24e808", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061199, "uuid": "d8e2a496-1379-4d12-ad69-48ba90642547", "comment": "Malware payload (Mirai)", "value": "4e85ffc0ee9cc56ff654c2a94a4a2fabba1f46b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061199, "uuid": "9a924325-26ed-4303-8798-75806ba75c66", "comment": "Malware payload (Mirai)", "value": "be8723378acf79a4056149f14b8f5693eddc8cb5ac27e9530adc3d1786fc5fd15d09348a06917a459386df56039a2651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061199, "uuid": "25b904dc-cc7a-4b28-b83a-331710755153", "value": "T17B43F2584747A982B561507FEC3C250293817EFAC29D70BF47E59624A9A2803D79FF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061199, "uuid": "d35cb144-7ae3-4828-8562-16f91955ca28", "value": "1536:nuRFbOvPIuVGn9PptfLqc5hEbqzI9Q40x:nuRFYIuw9PpFLq2EblaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061199, "uuid": "c45a48f4-ae17-4012-a591-5ea4e4e18c90", "value": 59336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061199, "uuid": "d7bb7c03-4cae-4fb3-9dcf-6068bbe17bff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061199, "uuid": "f9b8a6ef-e802-4aab-899b-614e057e9cd9", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349d5160-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003121, "uuid": "0fbe0fc6-e7d2-430b-b04f-6b704e70478a", "comment": "Malware payload (Mirai)", "value": "f3a4791ef4577539ed385ee2101295aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003121, "uuid": "5ce014c1-6b54-4531-b7c3-32a83203c13a", "comment": "Malware payload (Mirai)", "value": "9426f125d8e7088f1ecc05a10dee2d09267beece64437e700e76cadedd85c343", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003121, "uuid": "1757184a-af38-48b9-9022-9ff8ff72f36d", "comment": "Malware payload (Mirai)", "value": "87c34be56bbc653d764b8c816c55d9902ca28025", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003121, "uuid": "b55df138-c2c3-4a16-b327-98fa475cdf98", "comment": "Malware payload (Mirai)", "value": "c465f8468584d9331437e4545d62b51b6a9fe042ada9ab809f558496b99b8ad022a9eaa872788a8888c18f8e6beb954d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003121, "uuid": "fa5d5f8c-656a-4a56-8be3-4d6725b31721", "value": "T1EB83AF76F5142CE1CC021AB8F9F9C9BD03125DA840A62CB26F9CCE5148A7FADF44D7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003121, "uuid": "e3514a78-6858-462c-a726-decbe0f14837", "value": "1536:F0fWftXe0SxIWXHwb7bgsMl8tN6Iw4hsOislTHUDKhZ/i0z333jr:F+stKIEwPssMl8+mueTUCi0DHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003121, "uuid": "ae29dd39-15bb-448e-919a-b8977de8b22c", "value": 86752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003121, "uuid": "45d802bf-7801-472c-8be3-a3f953b48478", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003121, "uuid": "4744a288-dcef-4337-bc20-0aa67d391f1b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749facd4-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050044, "uuid": "12a02fb4-6b43-488b-aec7-53e976c38eaf", "comment": "Malware payload (Mirai)", "value": "ffae5070cafc588be40bfd528961b2ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050044, "uuid": "9bb65bdc-5092-43c5-a0cc-f96ae6174d35", "comment": "Malware payload (Mirai)", "value": "942faa9f600dc0d07d0bcc51f5e2a6b97d8f30ae10f93335257f491b7011e027", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050044, "uuid": "ef9e5321-6858-41aa-bc71-bae31c672e36", "comment": "Malware payload (Mirai)", "value": "868c9f17977d2823bfe9f7ace6cdc542d998eaad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050044, "uuid": "6ad68aca-f2e3-41ed-8926-7d944e106eeb", "comment": "Malware payload (Mirai)", "value": "abc171a5387d6b3b3be8e136848d1d6bf030b5aab11e6c563b4db455b48c11956c2f17f8dc23515f1b4ce80cc2ea0623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050044, "uuid": "adfbe2e2-7009-480e-96d1-5117b92debf9", "value": "T10F13F11D71714E96E3F514B9FC9802E298686BB891BB337315144BF8522246BCDFBAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050044, "uuid": "7dcbd2cb-bc25-41ec-b972-eb5f533e4682", "value": "768:Q9VqHEW2NYj7nWpoDopkRiS/HHO2Z/bXNQaj2SQWS007oJK9q3UELfD:Q9Vyprj7nuwoyfNpQy2SLS6J/Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050044, "uuid": "814ef9e0-47f4-46c5-9068-7a373e42e346", "value": 43696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050044, "uuid": "0b5e0562-01a3-4718-908c-c96eee55cf84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050044, "uuid": "abaebba5-9b1a-4081-8309-e359cd324164", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd96e51-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006120, "uuid": "9f888aae-3ed0-4f86-95eb-c82b0cbe4e1a", "comment": "Malware payload (Mirai)", "value": "dff07379d38eac7d18d1d0d9d6225ddb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006120, "uuid": "bcaf1052-ace2-4dd8-8167-c81c05bf96bd", "comment": "Malware payload (Mirai)", "value": "94c5ab58e47d0e09f3823a4683e50d5fbc45076a2803b1caecc1f1921ce6bd95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006120, "uuid": "7882683c-1b80-4baa-961c-1e812d3ca37f", "comment": "Malware payload (Mirai)", "value": "9a82f3e54b3973a924e04aa63ab9255db435e834", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006120, "uuid": "f5dbc71d-662b-4c24-9770-a91d20c3e5df", "comment": "Malware payload (Mirai)", "value": "d3d938d250f0ec9e8c05510261e0f49fb4b595c5610735cff91e76395b38d9d758be71feeb712510c128efa72d06469d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006120, "uuid": "3e6baa3b-7b16-4bd5-a00e-8be7bdd30b28", "value": "T1B43120D4AAE05E6DD9D082FF8C5D03587352DF4AE2D77612A20CB3289D1EA5CCD1B00B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006120, "uuid": "ef9b6039-77e8-436f-af6b-e853715e4e7d", "value": "48:7GJZo/6DIzagCpFaFaX8S0OLBmtBageX:7Qo9WFaFWAOLEtBa1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006120, "uuid": "aff510a0-c8da-4271-bc55-4da5ebc26daa", "value": 1776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006120, "uuid": "d4185be4-2edf-4b4e-82e4-8241fc6ce7e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006120, "uuid": "b6f5072e-eafd-444b-8331-563fa9e77a24", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb15ba6c-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038646, "uuid": "07e1f210-c23e-4206-85fd-cc4a2129f5aa", "comment": "Malware payload (Mirai)", "value": "f0500add3c64da29d10279ed8ba34498", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038646, "uuid": "54921f6f-970d-432f-88f2-8ef5e8585c7c", "comment": "Malware payload (Mirai)", "value": "94ea45f29e9a439d348c41df67ec0f8ffb41ccec99b740223cf5504604289087", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038646, "uuid": "cbbf98dc-1634-4dcb-a5ea-803390eda3f1", "comment": "Malware payload (Mirai)", "value": "d30b08e77401a6b7602a368b7ac17cdc2c8df649", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038646, "uuid": "dabc1264-f228-4abd-b8ed-905a5a660c28", "comment": "Malware payload (Mirai)", "value": "6ee7accda530c85790e561bbc5152af3050daedd0fb93fa8bb79dafd3a0f36f5e47817173a6b06a876ea9f97abcddbbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038646, "uuid": "2ad9e935-635c-465a-858b-3289fec74446", "value": "T11C833AC4F647E5F1E80701B03057EB36DA75EE351224DA6BDB94FF3B9932A52A10621C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038646, "uuid": "1fe5fe3a-58b4-4562-971b-cb5e02d095b0", "value": "1536:WjkAOfIvKGsw7mzkeKTuwlmTlK+U5jpUJ31kcRAovS0r:Wj92IvKxmmzqVlmT8v2acrvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038646, "uuid": "1cc980bb-6d76-4c37-9ee0-56ca0d8bf785", "value": 82564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038646, "uuid": "c92941b7-f96d-4070-a14d-79cfc813fa02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038646, "uuid": "8b6904af-a6bb-49df-a825-cccff35aa49d", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47becec-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050151, "uuid": "bcb4dc8f-e6fb-4d82-9887-a3cd1a299334", "comment": "Malware payload (Mirai)", "value": "bfc934a07a0b13eb7418686fb80defbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050151, "uuid": "b74137a3-6cc6-4348-a724-066fbcb07e58", "comment": "Malware payload (Mirai)", "value": "95b2e563a47c33632da330680683e01cc59327b7f132e1a3b625f5d444838c5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050151, "uuid": "1d01243c-87be-4829-ba0a-df3f32167853", "comment": "Malware payload (Mirai)", "value": "9bb570a5c09d86c6588959dda654d6b7013af033", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050151, "uuid": "4c39c89b-4695-43d5-a78b-e63a0affda1b", "comment": "Malware payload (Mirai)", "value": "b63e4d138f535aa5440ad5990581d2493abc4104716770bb5620bceb762f983adf9de93637f1df8cdfe7a24f581ef84c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050151, "uuid": "8ddcf6a2-80cf-488a-9c06-506f70b77b33", "value": "T1B0835B0375C0C0FCC899C17557AFB236C863B07E1239B15A67D8EE16BD8DE502E6A9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050151, "uuid": "8c6941f4-3873-448a-8300-0166c930fa60", "value": "1536:RsT6CjWT9kcxTfKM7Dst3g1f4M1YV3c47Rz9YxxE3Y53N0:udjWTZxTfZ44B1YV3cAz9YxEi3N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050151, "uuid": "2016c2ea-3ba2-4def-9857-aeebb928574e", "value": 85696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050151, "uuid": "ded84bb4-bb84-4fd4-a52d-e320de1762b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050151, "uuid": "aa285dc9-1c9c-490f-891d-aeb7a240f594", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87042f45-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002401, "uuid": "88933c06-3b24-4912-a036-2a54eb4c308e", "comment": "Malware payload (Mirai)", "value": "135cb4578045b780df6d5922f6b5419b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002401, "uuid": "9277e731-7027-4055-9553-7446865142a7", "comment": "Malware payload (Mirai)", "value": "96096ac15e52b4e520e4f19b9ff5700f4f93f8d25fd049b17f673f7cb683f3ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002401, "uuid": "6c738f0b-618b-4cb6-b956-a54d4cf722f8", "comment": "Malware payload (Mirai)", "value": "8de99b60d0a9c6748648f9c174630b6cf1b2dcdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002401, "uuid": "3ce8cdb2-a4cd-4c85-98cc-8a99aab6ead9", "comment": "Malware payload (Mirai)", "value": "6b1b9ac40d9efa7886064d7b2b87fcd87d178623ac30d130c32377bcb37c88b97dfc6ecd8bd31f2fabe1eaa0e71efc51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002401, "uuid": "26aeefbf-b421-4eff-a098-bda82c25aa8e", "value": "T1F9B32A40F98B40F1C8474934505BF33FDE32D5AA8171CAADEFA89E36DA27A01921775E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002401, "uuid": "432fd670-a29c-4460-8e15-e3ad4e190e19", "value": "3072:wTGpY4gNW7N2QjA+atr/dngFBS/tItf/kgJTzIoxg8:wTGpY4gNW7N2QjA+eZgfS/gyo68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002401, "uuid": "b633e60a-01ed-4541-a893-d18e4d70dc39", "value": 116432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002401, "uuid": "a777f368-c728-4c51-b206-e50e26a94b64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002401, "uuid": "094495ec-dece-4010-b5a8-63259ab06cae", "value": "colonna.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39cf6f0-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011924, "uuid": "1cf36e07-a98d-4c4e-a8c8-e3fd49183f13", "comment": "Malware payload (Mirai)", "value": "0e739ac35a9f8ce163d7592f7b7c53ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011924, "uuid": "144f8a4f-fcf4-4a3c-ba3d-b6b8ede7bb25", "comment": "Malware payload (Mirai)", "value": "9647a2928608c9fa2440c589256ca9a4f397dfae3a822c7fa9078017292880b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011924, "uuid": "a33aa855-c7da-4342-b433-41fda92d6949", "comment": "Malware payload (Mirai)", "value": "a85609936b5ef5c3e5933c2c775594a6a856f806", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011924, "uuid": "1d8124ab-56fc-412b-816b-5434b6a831ee", "comment": "Malware payload (Mirai)", "value": "fe70b510b17b83b5f268f539b30dc9ea37e08204b2d8c46631dc1834b85946ed6aa6611c7a963ebc3fddc123779f2801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011924, "uuid": "fc36e010-3bf8-453e-a126-f2ee368a2a2e", "value": "T1AC031A42322C0E5BC5A26AB0293F17E083FFE99025F4F585661F9B968675E371086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011924, "uuid": "e7603c05-1f9d-40cd-b1b1-0fd2813a4dc4", "value": "768:GfN8Idc0buXu1+bs3dzSWsR82xvf8rRMZ9DjUif3kixlST:Aqkp6+1+bmkb2ofUi7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011924, "uuid": "968d7397-5bac-422d-a7b4-8ebaaad213bb", "value": 40924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011924, "uuid": "8d5e74c4-7308-49c6-8172-3a9c3e373b53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011924, "uuid": "4fb218bd-81b6-43ef-8648-387aeef5ecc7", "value": "hoho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed9d77c-d290-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765017795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017795, "uuid": "822e1d88-d6a3-44ab-ada5-f7b45c2c64f5", "comment": "Malware payload (Mirai)", "value": "cedc077950f5b9a21a12dbaeb6cbc168", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017795, "uuid": "28993268-d8a3-4566-9f8a-ec0333c623d6", "comment": "Malware payload (Mirai)", "value": "967678bf1b5fd05002c4c1ceded4bc33d22631c859897361f495698faf450307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017795, "uuid": "c746929b-1e9e-4ef8-b5c8-6c5e0de71311", "comment": "Malware payload (Mirai)", "value": "046cf43fa354c4ac99bf91c57505ae5218cc5072", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017795, "uuid": "aeaa6759-9bcb-41f1-a0c1-70fb126a7ae0", "comment": "Malware payload (Mirai)", "value": "f785148fa79b6278344dd80fcf0a2bd8080992f23917fc88b0ddd49f78ca3a27dfc755d828d92cf0f2dd431aff1eb060", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017795, "uuid": "94a33c0f-7e94-42ca-a91a-7b13ef273c89", "value": "T115145C46EA418E13C4D717BABAAF4149333397A4D3DB730689286FB43F8275E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017795, "uuid": "b3267e6a-d388-40ad-9fb2-902b42edef0a", "value": "6144:CdH4Hks9dH+Wa78pvxdK0wlclCntWhsyOO8M/9BIqRgr:CdH4HksLH+Wa78pvxdtwlGa0OUd/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017795, "uuid": "c0c648f1-fe43-4263-98ff-e2a76add5540", "value": 200463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017795, "uuid": "3bf0d9d7-95ad-4ae4-bd21-5284d96f9f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017795, "uuid": "ca8f1614-19b2-4b80-ba92-52742db4fa7e", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdbaf60-d291-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1765018382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018382, "uuid": "9ce6fb47-3432-45c4-b72e-6aa7fd8a7b58", "comment": "Malware payload (Amadey)", "value": "42d0dc6ac0930333c19955086bdc00f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018382, "uuid": "aa111c6f-9cdc-4dab-a671-1d6c5a1b837b", "comment": "Malware payload (Amadey)", "value": "96d6b0603a4a13e1f7636ec2cb9bc9b2a5491c15bce2c1daf9ace7b60cd20fa4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018382, "uuid": "5ef10589-b15c-4125-aca1-710215e328ad", "comment": "Malware payload (Amadey)", "value": "880c9ea17b5286380a36461a52b9222411f555a4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018382, "uuid": "e0308993-b8ef-4a9c-9a11-715da9191613", "comment": "Malware payload (Amadey)", "value": "bcd155272b7176544efd9c8a24bb43dd091b2e1cb5a6096cb4e0279a91c5363b32f12b154794321baa5c62cbbe1952c7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018382, "uuid": "ef9f69bb-c8e6-454f-8ccb-6736917b111e", "value": "T15DF24B6E07D442F8DA9AC5B1E9B22903D3B1B0475FF1568F0171C4DA9F12AD3AD2C789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018382, "uuid": "99747994-9d70-460b-99b6-a55b6bcfd35d", "value": "8068d82e2993f851a750aba84fc72ca9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018382, "uuid": "06b20f4f-00a5-414a-9ec0-a546c13856f6", "value": "768:mnNlAP5jHPTjiBwEYkg3baAezJ3Va0H6+522QWOS0neIs:a45jvKBxKq35522QWOS0e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765018382, "uuid": "f6396296-21f7-4ec5-a2d3-3be28c4d7d21", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765018382, "uuid": "37a7727b-6639-4ba5-9150-83c42474f001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018382, "uuid": "15c32ebb-8ebb-4a74-9019-7a729fb08dcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da33bb1d-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048926, "uuid": "b711389a-3cf3-431d-ad4d-555bd457feaf", "comment": "Malware payload (Mirai)", "value": "4328cb182ec3abfcc59750a9d29e5517", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048926, "uuid": "f5c6842a-90c3-4260-a99c-aea5da91e18e", "comment": "Malware payload (Mirai)", "value": "973639299bb40745ea82bf34f644eef044a65458437c5791f7ed90b9a7cf5580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048926, "uuid": "5b458fff-c610-4e67-90ae-c528c45d1c6d", "comment": "Malware payload (Mirai)", "value": "4b8fb8e01badf27858fab16267311db213036469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048926, "uuid": "a114c025-09fd-4755-9cc4-e0adc8e4302e", "comment": "Malware payload (Mirai)", "value": "a0e34b470a49ec964bfd5a2f173c3ca4bfc5b8dc365c7071653e5c31df9d69f3fdfd06c7a8ade6ff4f0ef7aa103913b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048926, "uuid": "ac14e419-1ca4-4389-8e01-9092c59b79ad", "value": "T1EFC33912F98584FCC0CAC1340B6FB63AA935F1DD1238B2EB6BD4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048926, "uuid": "7ecd55ab-75d8-4cc5-851e-9dfe34f7eee8", "value": "3072:iY83TgBMfVw+Z7cHIzO8SoMFAIRHp9hApD7bhXiFkazQBV8IattGk:in3TgBMfVw+Z7cHIzrSoMFAIRHp9hAJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048926, "uuid": "ae2dbbc0-3a47-4813-9d74-b9783ae31c52", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048926, "uuid": "a3b2e131-45ed-49cb-9e90-06c0422ed0fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048926, "uuid": "fd3397d7-6292-4c3c-b4b7-b0ee2d9d70e3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81944e60-d2a6-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1765027302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765027302, "uuid": "0f2fd371-f8c7-43ee-b47b-df08b8b031f9", "comment": "Malware payload (njrat)", "value": "e688e27c047b412afe7480a6c1bb29fa", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765027302, "uuid": "8f0e495a-87cf-4965-957d-38ce973c3f1a", "comment": "Malware payload (njrat)", "value": "973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765027302, "uuid": "c7ef9ed0-cbb8-4f9b-9a3d-eb17fa36fb0c", "comment": "Malware payload (njrat)", "value": "2a95fdbc2ae9e8e8bdd27a5928c5723a4a61b4ea", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765027302, "uuid": "de6eee24-de3e-486b-8b0c-32d0c4d7372f", "comment": "Malware payload (njrat)", "value": "1cc58b22f414256d8da3ea786b56a77e58526dc7d7ff5f3c9dec32234ac14e9435be54f9e133903c7c782d5ce5370173", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765027302, "uuid": "0ed7721f-739e-4976-8dd2-0d5fb0ab002c", "value": "T196145B722613FDCA67BE3D80F65439D20C4D39A38B229658FAC41D6B35E62A4CF1D4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765027302, "uuid": "fcaad7dd-1a8e-412b-8224-d528012f442d", "value": "3072:9OaquQTjhhcLWdkBdxNKvjVcq98eMTY88Urg9LJ:9RtLhdx0vjVcq9BmmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765027302, "uuid": "48843ec2-a6af-472c-9341-db43c33857e7", "value": 193394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765027302, "uuid": "419cf2b7-1643-4cd6-8d96-681f59c85c05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765027302, "uuid": "9d6f58b9-63a6-4ab7-822a-5538cbf578f2", "value": "meto_dropper.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b996d66e-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033839, "uuid": "fc6861d0-63a9-41e4-9431-6ad3da4f7a8a", "comment": "Malware payload (Mirai)", "value": "5753d5a3aedce5c42e5728b9c0174e22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033839, "uuid": "9fd6a670-cef7-4689-a802-845a5dc20632", "comment": "Malware payload (Mirai)", "value": "9750d2decdbe2cebb5a64dee310d697c118a0edc8bb56b8232caee6b74c10985", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033839, "uuid": "b11ed999-20f6-4233-8684-ac8d21b9d874", "comment": "Malware payload (Mirai)", "value": "d3c7d6dc6137bfd09de162422547f8e0a97ccc50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033839, "uuid": "0f861e86-84bc-4be4-ba30-4dd9dc1911bd", "comment": "Malware payload (Mirai)", "value": "270fc86443385ae070d16cf802922129279083ab62ced167f3867a5454e00ae9a6f74c88f0e3852867720987f2779fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033839, "uuid": "c99e4582-9614-4301-9e87-c8de2da9b0e1", "value": "T1E5B2CF7EF8B83552C6791D78918C23174F981AC2B2EF4B4C335A58E59893357F64C83A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033839, "uuid": "6c2d6b77-129c-488d-bc24-a32384046101", "value": "384:HFlBUkgXosS2QACmjjAEdQqJIn4gh+tTyPBvILatUkc04GEmuig5VlVmVaRWGVCB:OkWAaLjjFeFn4JWvILath4GEmuiSQVmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033839, "uuid": "58bfa843-8041-4eb2-a143-728342805d84", "value": 24524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033839, "uuid": "3f09b8a1-6bab-4140-ade3-f73811c0d6e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033839, "uuid": "e54a3911-a1ba-4f8c-a43a-a6922775ffac", "value": "b3astmode.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b7fb9d-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002402, "uuid": "91dd31ce-59c8-44ce-bc47-1c41eee98676", "comment": "Malware payload (Mirai)", "value": "87c295aa43238ae7d19e2382b544b1f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002402, "uuid": "44531ddc-e4af-431a-b05c-4557985d07fd", "comment": "Malware payload (Mirai)", "value": "97b29c2fc6f0c71b0d0b74a399e42beeffe8f18876df47328e5cd200ff435a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002402, "uuid": "d706a5cd-1448-4355-b887-ed2f57fd9d54", "comment": "Malware payload (Mirai)", "value": "b890c70324038fdb46c461cc70a239e3c551f80b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002402, "uuid": "a521275a-b095-440e-b49b-1c83ac47cdda", "comment": "Malware payload (Mirai)", "value": "0e3e78c405a74abc198090cdd367229c647c73192d7abf34a27b96aca4acd6b023b91149b7a68a2a069576491ba2e504", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002402, "uuid": "d7546b10-8c81-45ee-bd93-044ea5e37245", "value": "T14D831988BC829A2AC2D11377FA6F118D372167E8D2DA3316CC6847B47A8A55F0D36F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002402, "uuid": "00eb4d5f-9f3e-4c29-86b1-bc697dbeb896", "value": "1536:1HDE4sfUZeIX2EcI70/i7MpUl//6FazmYB0m1BeZdO7inZn0TsA5Up1:9DE4sfuQ0UGBwUQZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002402, "uuid": "5bf0a970-f763-452b-ac03-42fbbcddc6f2", "value": 87612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002402, "uuid": "99eff6c3-953d-4ce5-a914-995088eb5e4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002402, "uuid": "30bec9d4-8af4-4935-8eaa-79d47bed268a", "value": "colonna.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4497745-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048916, "uuid": "e5d71fd3-8c30-4b48-8cbc-3aa18ef62c68", "comment": "Malware payload (Mirai)", "value": "17258d2446ea6ee654ae9c3fe9f6fd90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048916, "uuid": "25ecd749-7217-41c3-8380-a481a8d16ab2", "comment": "Malware payload (Mirai)", "value": "97eff87a5002dcb813964fd434f899afd3cbb84caf60dc6030469479beb6fb84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048916, "uuid": "3ad2ff6d-c7fe-4b01-afd1-7dc8698a9d83", "comment": "Malware payload (Mirai)", "value": "41d03ea60d4ff88c8cb0cf7d69495beccb2ef55d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048916, "uuid": "36044051-5d1c-48e6-8513-4ee201291338", "comment": "Malware payload (Mirai)", "value": "dcada127158d6212f13d4f1b3cce08abc2023da9c5d8fcf403281ddc94fcc88d87e27d212ebacc90a3dcb20ccd48eace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048916, "uuid": "791fa1ad-83d8-4579-bf06-9590cc9bbcc1", "value": "T10A04F639F2A1D23DD05292B41ADBC6B03770B0B46731234F37921B362D66A849F75B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048916, "uuid": "c85f6904-c308-4caa-81bb-582403a663f5", "value": "3072:RlGRWAv03RWAvgHNRWAvz+JD8sJeZUvRWAv8RWAvRsFARWAvNwRWAvZAAy1LwRWh:R+HO1JeZUT04+Lup/Jev3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048916, "uuid": "966e7a9a-eba9-4a37-a77d-f7ab258d6cb3", "value": 175528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048916, "uuid": "1eb28ca6-474c-4729-a41e-099874777206", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048916, "uuid": "2e44fda9-8217-47e3-8ec8-8afc252e2c84", "value": "dbg1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f393ec26-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038661, "uuid": "0682a3b6-0a8a-4024-8fff-ba74a3de536f", "comment": "Malware payload (Mirai)", "value": "1b5b1da447f756040597fa2448df619b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038661, "uuid": "8e222715-e0c4-49a8-9746-bee53c3e7da5", "comment": "Malware payload (Mirai)", "value": "987a469e31bc92def5c71cf238bc9259a88d0260aa32f36523302ef80306f5b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038661, "uuid": "31a27fc7-406b-4051-930d-8c3ad2fa95f4", "comment": "Malware payload (Mirai)", "value": "90d9567ad546eaf4fed468cb7cff571a06205a81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038661, "uuid": "4ed69b6f-9198-4035-b623-985513b9f765", "comment": "Malware payload (Mirai)", "value": "20b55a54631feecdeaad07511c5a1a86ad8691f2e18d3a7a709b31c1b9499b4365f72f6cd88cfeda28f977cc6e677c38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038661, "uuid": "b4003cf7-39a4-4d6c-b81b-5e26076bece9", "value": "T146311305F2281817D8E17D747B7B1B879B3B4F130634524469CB9796F5748740D8E4DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038661, "uuid": "27bba50e-43ba-42f4-95ff-6322990b24aa", "value": "24:3ori5nSWSxnSWW6S7IOSA6SBARKPfZXensyeR7hrVtffnOA23vt6f+jOxHvdzcM:ycc2N7ZX4beR7hxtffo3vlSH1zcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038661, "uuid": "280234e4-e221-48c6-94b3-f5f7a4c59e8d", "value": 1736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038661, "uuid": "fdaf198b-d3b9-49ab-88e3-dc37d3e7f057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038661, "uuid": "5699bc61-2d51-4394-80e0-0556e8185b37", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d363d0bf-d269-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765001240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001240, "uuid": "85c25d10-0155-4f05-b512-15d9ed4e6f1e", "comment": "Malware payload", "value": "b577ffbedb35f432ddfbd0eafa6e2e97", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001240, "uuid": "504ca46e-d7c0-4c60-af6e-5bdea8349ace", "comment": "Malware payload", "value": "999949081963b66d63efde64f90b6b435e957882c1ccaa7f92a5419eead101fa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001240, "uuid": "c001065a-9bc0-4075-91aa-89a23d2bf89b", "comment": "Malware payload", "value": "20b3366716ee8cb6188840817bd6d56f08719016", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001240, "uuid": "85abc29f-d092-4052-b850-89b72f11115d", "comment": "Malware payload", "value": "0a55073b2262e259989c8e8727e3dd398fd66dffcadf2017c471b3167e8900b25c7ae03cf563dc4f7f4ffd11404966c8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001240, "uuid": "54300b56-6f22-4b79-99dd-854a14c0a021", "value": "T1EAB56B4BACA15CFAC0A9A2318872518ABB61BC451F3123D73E90B7BC2FB2BD05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001240, "uuid": "c7ad8169-9600-40e4-a4dd-5f795161a9ff", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001240, "uuid": "1866eb80-e8d5-4196-a6ec-ecb04bcfbb38", "value": "24576:Gk16BKj3GJXok5de/9icy3dKkV0MV9O6l2tuGmcoeleTNj4HGu2+oc3rtSCxL:Gk1E+3kok7e/EFtKEV9UmPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765001240, "uuid": "7498efb7-d692-4273-abe3-2e222e3e9b2f", "value": 2387968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765001240, "uuid": "94552645-2c6a-474d-a987-9c2012f6c945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001240, "uuid": "cc64de50-6649-4aff-9544-22384c6dcd9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deaf183d-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048933, "uuid": "52c1b5a4-11fc-4239-b946-20a5e49d7c6c", "comment": "Malware payload (Mirai)", "value": "8a2d862c3c4ea941edec3bdac25a8dc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048933, "uuid": "96eea42d-0671-4448-833d-41eede0bd72b", "comment": "Malware payload (Mirai)", "value": "9a1eb80776ed1019c9eb18873c3c030f62fc0df7cf852e97181a11c03900c739", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048933, "uuid": "fafff894-4fe0-485d-a09a-5d8eb78dd369", "comment": "Malware payload (Mirai)", "value": "8e5fc269720d652198412334f2ea43ba198effd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048933, "uuid": "08176716-c912-46bf-a561-31e8cb658937", "comment": "Malware payload (Mirai)", "value": "ad2f343d6340ee8c195c97aa8f2736391eb802b174bd750a0f0fb8c8b7715f06e261a26ae4150ed4b920259554000fda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048933, "uuid": "1a846c39-e858-4e25-92b1-c0bc9a1f9005", "value": "T14FD34A2275391E2BC4D0987E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048933, "uuid": "5d483bf5-ee18-45a0-9fef-daa218126f92", "value": "3072:1CldeCsOs9kzj2vV44qURgyOykV30Qm9Jlsb3jF4:wPeCK9kzivVjqtymymbTF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048933, "uuid": "f12f402b-2ebe-4c9c-ab45-9e185141bbf3", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048933, "uuid": "593790b0-f780-4aeb-950d-fb8637addac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048933, "uuid": "e42847ce-976b-470f-b961-366fe49ac56a", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053f8d6d-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042126, "uuid": "64683d80-6b6f-4c1b-ba4f-9f9bfbcef2f9", "comment": "Malware payload", "value": "263454ca3273257ff74f0f412cf13d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042126, "uuid": "893e10e0-0429-498d-b59e-f7015a625e12", "comment": "Malware payload", "value": "9a5fbc975f0c8d292e6b55b74c06a36a2fc2287c0776fa18bb4d9058204bdefd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042126, "uuid": "9a44564b-6d28-42a6-9672-ea914211289d", "comment": "Malware payload", "value": "0119d3bac846df6821a1f3c4b15294d32ff9e40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042126, "uuid": "76438cc0-0b09-463c-8958-303afc731918", "comment": "Malware payload", "value": "8f559bc552acb6a5d74bc821bf75bf28cc653255bc61a5a17e966b711c39d7ff22d791352cacfc57b95c5a98197a86e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042126, "uuid": "0ae0cc5a-0fc2-47b3-8aa7-b88463128d52", "value": "T10CB366212AEB109DF3B79FB12FD8B8FF49AAE5B3291D70B9204147064761E84CD52B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042126, "uuid": "52304f25-16cf-4dee-ad5b-6d713d134d67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042126, "uuid": "7dce7c49-5b85-4609-bde2-7da69884d897", "value": "1536:QmbZVcOw9eUwy6dePF7d6foYDT9QtYLjvscOwy6dePF7d6foYDT9QtYLjv:Q6ZVcB9e/si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042126, "uuid": "97e78d94-7e00-4254-ad62-21b22b63ac4d", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042126, "uuid": "3236a8bd-415b-405f-8fdc-8fe49e153654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042126, "uuid": "64521e0d-e658-42b9-9a1f-16404e076688", "value": "FleetAgentAdvanced_embedded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58428182-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042265, "uuid": "6034319e-5b5b-435c-bedc-f11987cf6571", "comment": "Malware payload", "value": "f0f9e4513d20ff233ace585706a6a034", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042265, "uuid": "36ed9a8c-f505-4764-b9cf-861ee828f3b1", "comment": "Malware payload", "value": "9a9f50a30dee2f71afbbc88e624c7ddbd4a68cffc753a85395a9c18a2a8072f4", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042265, "uuid": "02805aaa-f036-4c54-99bc-dafc0c3ec793", "comment": "Malware payload", "value": "28e272af11d43aa2ba4bac04d757f2f9405481cd", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042265, "uuid": "576c6e62-918d-447c-8a21-59d08c63603b", "comment": "Malware payload", "value": "6db22e2aa631def5f80b906d7448922393da4e85341e75a0e4bddb2128e5f1c25a99bee9e4cfa923b0a3d1b43b8dd179", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042265, "uuid": "2c905105-7a49-447a-b495-2904a268a4dc", "value": "T135F15328D1152919EA63C27FCA84A3517867A43F825E2ED876ECC2997FC133C4BB51F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042265, "uuid": "d7058278-0593-40da-87a9-77c7907b4b84", "value": "192:zyXhe0eAELpktrJGY8bWakJgUD22jSS1vW:WYetTmajSSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042265, "uuid": "699f36aa-e00b-4d4b-95ff-f43e68da97a1", "value": 7992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042265, "uuid": "6e5306ce-9a89-4821-a872-484133fd90d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042265, "uuid": "5bc514ee-9e5c-4f90-9fff-b5ee901e87c2", "value": "silentcleanup_bypass.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b2ba7d-d2ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765057424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765057424, "uuid": "82f26190-34cd-43f7-8b5e-b6f11a48e05e", "comment": "Malware payload (Mirai)", "value": "6744140d374bd8850f8dc07ccb7c7f8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765057424, "uuid": "16686edf-d7a4-4e57-8991-921a9ce6a0c3", "comment": "Malware payload (Mirai)", "value": "9b1c0a304cbef724c4d10f70a51616574270a11498c8ef62db288a6f90f5da5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765057424, "uuid": "b998ac73-8939-43a5-b63e-ada1a23daf09", "comment": "Malware payload (Mirai)", "value": "4c32f37bc13246a66df8ef3506a3e3bc42638deb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765057424, "uuid": "ab718661-c672-4f84-a7f6-dc6e749e5c84", "comment": "Malware payload (Mirai)", "value": "c42db0f3a4a45ed816c507320f0292646d9b8c5eb32c7cb6cad3f1adc7295aa5501d954060f850be11c39cc10067ea93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765057424, "uuid": "cd1375b5-3084-4bef-81cd-24848aa16ca6", "value": "T1A583C506BF510FF7D86BCD3706A9070225CDA91B22A53B767934D82CF50B64F5AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765057424, "uuid": "a1976259-e699-4b96-b381-61f0a38bdcf8", "value": "1536:512K7JYhhnI85cy0PDoxKgwSZZBNGOpbIX5:512KmCPDoDwSBVIX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765057424, "uuid": "c2773865-5878-4b6e-9a10-7018fd16a3df", "value": 84832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765057424, "uuid": "c6d33baa-2ecc-4e4d-b265-8e5a55d4593f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765057424, "uuid": "c25ac514-6a28-4e77-9875-0f3576d51af4", "value": "fent.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09265cd3-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042133, "uuid": "d36d3c0f-94ae-4bd2-928d-544fcbd4cff8", "comment": "Malware payload", "value": "1b80879e9f06f4338b53ad124979700e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042133, "uuid": "8728a06c-78ea-43e1-9092-c91a814673c1", "comment": "Malware payload", "value": "9c79ffd1aa2429e60644252c0f41ef7238da1a8bb781c60e62d021a4b724bb15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042133, "uuid": "ecce5a19-26ec-4ee8-ba0f-301abe2218a1", "comment": "Malware payload", "value": "88f76d25ab755db54c87b5cd81fce9c52011ee82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042133, "uuid": "961b31aa-4212-4da4-924f-a6ffd391415e", "comment": "Malware payload", "value": "4e861d37a97043907b1e55a7ac2a009ba3acd9f8a591cd6d14106f842ca71c20e3406c1484b2a7addedb68092a102d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042133, "uuid": "b6d612b4-8f92-4186-8fa3-b6be7643f898", "value": "T184B20804B7E88758F1BE0FBDB873422455B2F9970936D79D1CC9609E1EB27C49A01BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042133, "uuid": "eca5fd44-f7a8-4ffa-b1a4-29ec754f353f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042133, "uuid": "ab610897-bb31-4675-ad5b-42ddae99f066", "value": "384:7PQ5VkTbkdS8SFAULq0/AfvH9lq3/ZwneYRSFSe+5FnPMe2eOpOONQWcxYW:7PFTb2uF3O0/OH9w3YRSFMcOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042133, "uuid": "7ab47393-205e-4fca-8baf-669382965d8d", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042133, "uuid": "ef4af615-7319-4346-9819-4f44464ae873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042133, "uuid": "0904582f-84c5-4646-8fdc-b1c7aefce87b", "value": "FleetAgentFull.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7b0d3c-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050143, "uuid": "2f775b0c-712d-480d-9001-b4e58ce1d263", "comment": "Malware payload (Mirai)", "value": "9b70b51ea386b3f0b5efd32005a05fb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050143, "uuid": "27509252-7ddf-418f-8d79-4f9eb5628a18", "comment": "Malware payload (Mirai)", "value": "9cb374231b25bcf30bae62d76617cfaefc0a114805ec981d6fc23c7b2a887f0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050143, "uuid": "0ca574db-4665-40d1-b99e-ab5b90590388", "comment": "Malware payload (Mirai)", "value": "4fb12e5df083088bebe73b6813f26d9dbdc1dae8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050143, "uuid": "1d666114-207c-4fdf-9471-39a68c27d122", "comment": "Malware payload (Mirai)", "value": "7a11bd86da75db372a441982ed51e617442f30db6215654e92858f64f676053300e102af79d58c59eab630de51b1ee33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050143, "uuid": "fc7e73e0-7ecb-4e43-b34e-9c6129cdf7fd", "value": "T17A8328C1BA8BC0F5D80748305067F23FCB32E63940A6D65DEF6A9E26DE375416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050143, "uuid": "84a5cff2-f368-4892-9460-ac56744cde29", "value": "1536:UMpfl9OnpbStfC62EW4yoWpawNK2I3cKJWaEfI9u:Vt9Kp2tf52E6IuKb3XJFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050143, "uuid": "c4253363-4f26-43aa-a92a-d859cf53243f", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050143, "uuid": "1a1a652f-96c6-4820-934f-9f25cb380459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050143, "uuid": "7e76702f-fe54-44df-8b8a-104a467eae07", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243d53f5-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042178, "uuid": "140795c3-5561-49f5-94c5-a06f24109732", "comment": "Malware payload (RustyStealer)", "value": "2d18e970ba818f7363a2027192f81bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042178, "uuid": "09255c5f-5562-41bd-a571-56ac01c8ec3c", "comment": "Malware payload (RustyStealer)", "value": "9cb6adfd5fe0acf5dcdd74d5f721c7955c069b237bc7ca1a1f054083487de573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042178, "uuid": "28aba885-2e2b-466f-a59f-31cf77b49f7a", "comment": "Malware payload (RustyStealer)", "value": "b038c1e43dc7efc4df541755edc1d65ac35daf61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042178, "uuid": "fadc38d5-2606-47eb-aeec-e97ff0e2f6ad", "comment": "Malware payload (RustyStealer)", "value": "97a3d860e20b2654a81b8f7b323b250dc3fb55de9d9d5f95e8ff8395725f328bbb2d1cb0157d3ba56e2b5b8f32bc0ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042178, "uuid": "fae352e6-cea5-4216-a54b-2e54be1f62ae", "value": "T14CA56D03F3A581A9C1DEC1B98705A775BD7BB88D096076BF0AD34A303E69E944F1E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042178, "uuid": "ab5a7dd7-ef1f-46c4-9718-f9398f221d86", "value": "5aff6c59906e71ba7f18f6b50812a6ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042178, "uuid": "20aa6fed-f238-4c44-9832-fc0866a82d9f", "value": "49152:OGjP0ydCl6/xSe7J88HxzA+8kgMWRYO58Eg:OGjPrJ88H9WOgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042178, "uuid": "47290521-f8ce-4ade-8220-bec798536c03", "value": 2129408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042178, "uuid": "846c7cd0-ae63-42b4-a91a-478d09126f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042178, "uuid": "b705258f-4598-4a63-b2f2-3fc471859bdf", "value": "dec_orig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d0bb56-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042293, "uuid": "344ccb5d-047f-49ed-941f-0efc142acd59", "comment": "Malware payload (RustyStealer)", "value": "91874b34526a38f9ca0727f323c3188a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042293, "uuid": "9c011a62-4883-4f87-b94a-cd3632b40eb0", "comment": "Malware payload (RustyStealer)", "value": "9cf27311a39f4915ef1ea36f101381c4b3b7fe0eeea43a9739df15c06a563651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042293, "uuid": "eb488385-7851-455b-92d3-133959dc4af1", "comment": "Malware payload (RustyStealer)", "value": "45714cf92b5820ca115568d8f4ea48293dcc66b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042293, "uuid": "187d91ea-d2b6-4546-bedd-1ac388496be7", "comment": "Malware payload (RustyStealer)", "value": "091aaf1198948d71b0a7065e3bfee705ccd0b7e50a210978961de4feb9d13b669c389e8fa49fe3d3ffe29f90f1290536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042293, "uuid": "3cc91612-cfaf-47ab-91d4-0d2f14e0537f", "value": "T10C857E07F2A581EDC09EC1B48346AA33BA36B8890621B9BF17D55B703E66F514F1E70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042293, "uuid": "6cef339e-1d54-41c1-9e36-6397bbd28692", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042293, "uuid": "bb51747a-a193-4c75-b61d-04fa02f94243", "value": "24576:fYnOMEeCG6p7rkwOmb0/GSybRvXmptDZ17J5nqjGI8Z7/l7:fYnOMhCG6tM/GSybJov7J5nqjGI8Z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042293, "uuid": "80ec7c1a-8b74-47d3-9116-6b43b6275c64", "value": 1709056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042293, "uuid": "5b81cb4c-94d0-4f10-84d7-29d155959289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042293, "uuid": "8ed64e3e-5323-463e-b290-3dc1ba80fca5", "value": "updated_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaed669-d2dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050349, "uuid": "a4660c1b-d550-411e-b5f3-3bd0929d3dba", "comment": "Malware payload (Mirai)", "value": "68018fe0382b5c50a8b0747515c692b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050349, "uuid": "a0e78ab1-7b59-4341-bf5f-44ce62f1cd51", "comment": "Malware payload (Mirai)", "value": "9cf7579815770a9c92f9fb25dc94b88e96ab17f3718a4e150b21e26b33289445", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050349, "uuid": "08e6fd0c-60e7-4d89-837a-ae473365be26", "comment": "Malware payload (Mirai)", "value": "db957d9fbf7881838cc93bfafe89f48d73f8c14f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050349, "uuid": "05161cc2-d8ec-4de2-b26d-c6c33ae07dbe", "comment": "Malware payload (Mirai)", "value": "b91ad507a64dea256e39016c9af64f2fc16d77ca84280601f953d16ba6967f112da65a2b1ed7b616c3d16512ff2dbb7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050349, "uuid": "9e3d18f5-4165-4aeb-a605-13585be770b5", "value": "T16533F791FC82859AC5C057B2A76E568A73A2A3E5D2DF3313CC584F1036C561F8E77E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050349, "uuid": "677be90b-ab6e-47d2-a82e-3a1b4978f217", "value": "768:POIoXB5lg/3UAGfF7N4fR5S7lJbnnJojs9PTp5VDRd/foK/M5GxRNT80nkz:02/kAGfpCfS7lJbnnJ/PTp5VL/RwGp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050349, "uuid": "74af03eb-99eb-4d63-b4dd-c0a70d05fba1", "value": 53744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050349, "uuid": "acda31c5-5a4a-4f4d-83bc-441cccb90a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050349, "uuid": "8b524f9b-8006-4995-a8d7-a881160e5ef9", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c071bf90-d2e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765054037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054037, "uuid": "0d77c1b6-fd92-4b42-b2eb-b414adbf35ab", "comment": "Malware payload", "value": "df38c487325f043a65bd38d16b1517d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054037, "uuid": "e2e7cd96-7544-44df-933b-3c9f501e59fc", "comment": "Malware payload", "value": "9d357002fdbfe5dd7f0b963dfc3da9a654467097a38db70129ec52d878a9775f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054037, "uuid": "dc68a024-f44a-47c7-8e33-60f842d5d5ef", "comment": "Malware payload", "value": "01427802e98b990e878d6dbb9e6831a69e1ec4ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765054037, "uuid": "fd7245da-b3d8-4ca9-aabd-dfaf1628ad23", "comment": "Malware payload", "value": "566c0771e846ad91ebc1fe2c7364b1112baaa3b19b60fe39cc09d779c885dfc5c8d2d0fecb91714a61975e05d90f8231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054037, "uuid": "c8994d27-41b2-4652-ad94-7ea981fa5179", "value": "T1715506796450D25AFE3980B950F6875EB120713286722BFB0160D263EF1B5B1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054037, "uuid": "7ceb08a4-df56-447c-a41f-4e6d7a76ac8a", "value": "a40658832e597eab10a2b68099d8706b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054037, "uuid": "c70513e7-c30e-4747-a895-858f889a6084", "value": "24576:AgT3C6mMxJEhDLKl8JoLP9K0sQxpx9Z0Fo/tQIb1Ddo2QIdz:AV6kKuJmrqEHbhdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765054037, "uuid": "3934cc03-d503-46c1-bda2-de54a655aa83", "value": 1344000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765054037, "uuid": "210bcc11-06a4-4351-a6fd-a3270f5d7402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765054037, "uuid": "c59412d5-5706-452f-8a00-5454fbccfbd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c96837-d2f8-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1765062305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062305, "uuid": "3e3402b5-2093-4a01-8f8a-17806c881f95", "comment": "Malware payload (CobaltStrike)", "value": "e57f0bc4924dfc879e316db637f19147", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062305, "uuid": "d46fa3da-68e3-492f-a7d5-f0422e2ca1ae", "comment": "Malware payload (CobaltStrike)", "value": "9e0833cb67e666b9f3ee513c162d99287ea61fda8efb10b35ea659cc58c4998d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062305, "uuid": "a5d9e61b-d397-4d02-9be2-6bac7efb6f0c", "comment": "Malware payload (CobaltStrike)", "value": "b832a09c7cb30b7940f3ca25ac0c6ebb84577254", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062305, "uuid": "cf0bb3f9-7e67-4f34-a87d-03c627e58fbb", "comment": "Malware payload (CobaltStrike)", "value": "7bd101a1c6fa2b11fcf8e42b3e722b542d478ae23f777d198d07a5286f3817c128b8ab2961ec092c96c83d87535586aa", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062305, "uuid": "b505b06d-31dd-430c-8af1-0c78306e8c22", "value": "T1B1648DC28D62F902D18DB37D8B03FDD6D95194E4196BB52BB8502AE13EC8E36C7A111F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062305, "uuid": "a63b64a6-05ce-4ba4-b65f-858c57058246", "value": "a17186a0dbc86b565628d4a9b8c9cc17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062305, "uuid": "f94f2511-b6ce-46f5-acd6-154e4e01e3b2", "value": "6144:9CEmQEnjSQOYuiu3REjaQQChxm3LO8MDxm5S:TmpYmGlChxm7OnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765062305, "uuid": "e2eac812-a94f-41a2-8cf7-47d2a5775af0", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765062305, "uuid": "8e3ba0c9-57b7-4e97-b896-660cacbc69bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062305, "uuid": "b4d31ea5-ec2e-401c-8898-dac56ca36d7b", "value": "beaconx64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d0b406-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011928, "uuid": "2aac2838-0134-45ab-a0c0-b8a9290d9710", "comment": "Malware payload (Mirai)", "value": "6bcc7c288298c18eb7327e62ce3578ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011928, "uuid": "feeb0d9e-1714-4b98-aef1-9d50198d76fd", "comment": "Malware payload (Mirai)", "value": "9e3390cf3d7f3872d46900d26af9ed86e5ae6a60cdec5ca4ee8233ab7864bc0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011928, "uuid": "85f0bf13-017d-4da6-a58f-5eb87bfb757e", "comment": "Malware payload (Mirai)", "value": "8d7438ceba0608f31d627f84e6e0138aa142f319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011928, "uuid": "b27684d8-796d-456c-895e-be080d648b6a", "comment": "Malware payload (Mirai)", "value": "a654c98109b981234215ccdaf123dba53a04a9f80bfc17f7d85b1b7f77cf4cada4a14517a4c2dd990bb86d2243f56cb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011928, "uuid": "4239557b-635e-4bb9-9a53-805246b02a6c", "value": "T19C438319BF650FB7EC6BDC374AE9174524CC641B21A93B397934D828F24B21B19E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011928, "uuid": "7c06127c-e68f-452f-8d84-4f9044ca977f", "value": "768:13fMq8ARZVorpkT8TkqWgCAcVeP5xkeyezAeNN5dIWkLS5xY4TTXiupbHubr:13fMq8ALVDUcVIUfiACNIkXHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011928, "uuid": "e3c89df1-225d-420d-929a-9e5213271b53", "value": 59192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011928, "uuid": "f9fe8d87-e907-442b-9b21-c1d0cfaaf276", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011928, "uuid": "c0ebd626-77e7-4775-b159-27424ab85819", "value": "hoho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a6d424-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043467, "uuid": "fbf2c304-1e6a-44db-b5dd-b7293b469b47", "comment": "Malware payload (Mirai)", "value": "bbb200c310149a9a6e187773f188861f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043467, "uuid": "35c1c5a5-a5ff-43c5-b777-96ebcd4be9c7", "comment": "Malware payload (Mirai)", "value": "9eb53795ab94a0dd7af7f05eb8d950a9858da8ca74e9ec98350f6f72ae6742e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043467, "uuid": "c631e285-7f83-4500-89dc-c509f2d229c2", "comment": "Malware payload (Mirai)", "value": "3bd7936874de21a9845b3d930c81e86bc75e70ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043467, "uuid": "6932a288-5252-4ba2-9b75-6ebe1da6188d", "comment": "Malware payload (Mirai)", "value": "dfc611cc01df7b3838b1f97f6dd48c1e29a74014e5815d25c9b3975bbaf7a09c533c641fe37c06926af843327d744ca5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043467, "uuid": "08c4bec6-d8a6-4c4f-ad7c-3be4fcd74923", "value": "T125F2E105B20FD8A6587C8476DB4A81E724879BBCB4C7739ED294431CB76508A69F7C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043467, "uuid": "3b36c99e-e3c7-427d-8be8-4b9c89e150fa", "value": "768:kKiQ47RQ8V6Zcew9jmkuynoEP5JCrtMST5AcK/Bt819q3UEL65:Gx7nV609jm855JatMQEBTLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043467, "uuid": "14986e35-ddfe-4abe-b467-2f4d3f2135d4", "value": 37248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043467, "uuid": "1b04de22-2ecf-4dd0-af71-f8af0c931835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043467, "uuid": "69cea0e4-9ba5-4412-988d-ba5b791e5063", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2462c7c-d2fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765064321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765064321, "uuid": "cdd430ee-9e69-42f1-bd1f-17f52fa9ba1a", "comment": "Malware payload (Mirai)", "value": "a7f95ffeda9770db5cdd92ad45f1f2ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765064321, "uuid": "8e16eda5-543e-4cde-ba75-1d14a34a376f", "comment": "Malware payload (Mirai)", "value": "9f1b8f653ba154b76e9f8adf432714d01b0f44fd014b49fcd8e7dcaca5b7640e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765064321, "uuid": "821183f4-fab8-4d25-bf77-62bb9e0efa9b", "comment": "Malware payload (Mirai)", "value": "34a0c6fb93a43098b4eb38a6ac151557a43dee98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765064321, "uuid": "6773f53b-4739-42fc-bcc6-ff9b414d2190", "comment": "Malware payload (Mirai)", "value": "73e8298f207cbf848cf3de4bb937f59a3b8adb6ac37e97dfeab9e5872e6f8a62ab704123620c3eb8f47265b5c4a9b4ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765064321, "uuid": "037e3bf9-ec95-40fe-acd6-de516d400737", "value": "T1D3E33C56E6818B13C0D6177AB6DF42453323AB64D3DB73069928BFB43F8279E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765064321, "uuid": "68a10417-6468-49c8-8970-6d9096759102", "value": "3072:BVTsufrTpance1sa3lcvmqSxxSrkqi1MM/9bW3IY:BVTskTpance1saOvoOkqiSM/9baIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765064321, "uuid": "fff44ae1-7594-4200-82d9-3369092d6738", "value": 147532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765064321, "uuid": "0f8525b2-4b96-40a1-9e8e-d119c89bf96e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765064321, "uuid": "dd88d4a0-133f-4819-addb-18a2fc3e6a5b", "value": "fent.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca7e614-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038676, "uuid": "98d1f981-d1d0-4e63-8f0c-eedc547bb7af", "comment": "Malware payload (Mirai)", "value": "8346e9aa7ebf985ac3c35193abacbc75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038676, "uuid": "b05dcde2-857e-46ca-8567-1c23d637aea5", "comment": "Malware payload (Mirai)", "value": "9fbd74b59f7baa59d70cdd47bc9a1c4932416855ba9ee74166f3c632d3a2f131", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038676, "uuid": "cad41785-1c2b-420f-9ae5-f7de3801037d", "comment": "Malware payload (Mirai)", "value": "577bc4a1c6e41ca6710dd88bf2de462e243dbc53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038676, "uuid": "640686b5-8c19-429f-bf0c-f0335e6d9651", "comment": "Malware payload (Mirai)", "value": "1a60decee6b7541f9d9314af2aa6c3158673db0d7b40851ea80a95ab4f25fd25ce241687572351f9ca453e5c7360b171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038676, "uuid": "48507c38-3f82-40b8-beb1-c5173df2fc6d", "value": "T15C510F8F1A12DFE4F0A8D53847B35E75435A13DB22E59686F1ACC6000E6234D9C5F6F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038676, "uuid": "eab1d88f-1c54-423e-b6ab-1af8e2b5a3bb", "value": "48:BudpwV2iITi2QkjNikvpt6wqJkCE8EUPSHkInzHhmVAuPHx79dL+mZfKqubpE68y:odpwVtmi2QvkhGTE8ESSEIz4lphdALXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038676, "uuid": "9f0dbe64-d2af-4bfc-b854-f4eaa1ff13ca", "value": 3052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038676, "uuid": "915274ac-4063-4e28-95c5-42724f3b8948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038676, "uuid": "3981c9f6-416a-4fe7-bcf5-02e97c17c4d1", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e06dfea-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042168, "uuid": "d9bb9885-dc00-4f45-97db-a423074a395e", "comment": "Malware payload", "value": "bf80747635820fe3d1cf15fdd12fbaf6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042168, "uuid": "24fa4a75-26cf-4647-a113-4a36ef53d138", "comment": "Malware payload", "value": "a0476b5014f21f5905d4b95dcba641ae133eaa4ba5b4dcfcbe2814c6a256babc", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042168, "uuid": "6488d678-25ec-4aee-8b60-630703ce3175", "comment": "Malware payload", "value": "9cc02ea28196d0367c1c90b1e63cf450729f4009", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042168, "uuid": "3294cfb6-7be0-4946-8210-b1f6b2ab2610", "comment": "Malware payload", "value": "735fb48ff388ca81922e18f99662c31bc6ba455285d6c18953b969cbaf2467d4353631febaf8342c8d0f6ce13b815eff", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042168, "uuid": "53443f28-d6c0-46fe-a390-3f859658e1b2", "value": "T1D6B1852854922A1A5833005FCF55A710A497D0332B8EAD90B96CC3B8FFD736C57B12A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042168, "uuid": "3843555c-8f3d-434e-9ca9-c813ab443dd8", "value": "96:vUj9ZmyLvEZGDE5r+bZ7AIa0QIimFEwJv3ZbAi6Ixf:k4+bVZa0NiAEsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042168, "uuid": "0c7312d6-fc4f-4fed-b898-d199177ad97f", "value": 5213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042168, "uuid": "847f2e62-22a5-4293-a2c8-edbedbbc4642", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042168, "uuid": "eb5f0b0e-67bb-4d0d-960f-e29eb6b54b2a", "value": "com_uac_bypass.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3726a0-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049845, "uuid": "71179b6a-3c18-49d5-9911-c4a7c444a197", "comment": "Malware payload (Mirai)", "value": "7903c3036420831adb5c7c65cebbf8df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049845, "uuid": "c8888cc1-c340-4f14-b764-ff0fde1326dc", "comment": "Malware payload (Mirai)", "value": "a0974274ba32cb452a720bd0eda3abff5e6820a8ce8e10b497a721cf48f50967", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049845, "uuid": "fcfa05dd-6cda-41ff-9ef8-adfc681408ee", "comment": "Malware payload (Mirai)", "value": "2515894e9f0537818381f4b8e06dfbfe181c5a8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049845, "uuid": "3275619f-c9c0-4d09-ac18-6625e2fbe90f", "comment": "Malware payload (Mirai)", "value": "5b6cbf8767c8ddf742e2074bbe12bdbb8566253bcbb560f4152d1602118298acb3645488e57f58c171fca576badc1720", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049845, "uuid": "250a6af9-7009-47cf-a6a8-623d1415e28f", "value": "T179156A227720EF65D329C63409F3C6A466E522E22BE24196637CC32C3E6126D5D5FFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049845, "uuid": "3cced1b3-35f7-4c3b-b843-e984f17788e2", "value": "12288:F53U6iBGq3FPIhuH9bufIelqgDTXv7m3Dy8pStrvmBZkXcFAyMWUK0Tk:F50Z3FPIhuNurz+irv1WTUK04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049845, "uuid": "e35f85bc-d296-495f-a97a-331480f52019", "value": 952168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049845, "uuid": "e45c8670-6842-4055-93ad-b05a6735b1ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049845, "uuid": "6b78a242-2499-4cb8-a57a-b632d3d1874b", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863bf48c-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061240, "uuid": "f946da9b-a9b0-4e6a-a2a9-7383765601f9", "comment": "Malware payload (Mirai)", "value": "def25b544975b132ebc83a519cd3e76f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061240, "uuid": "9e028e05-32ef-4975-b1e8-7d70110c2eab", "comment": "Malware payload (Mirai)", "value": "a09b64a93b0d86a2d0b39ebf1cbe299b9378f108383fd78b7459ec64b7021621", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061240, "uuid": "dd1843b4-ed37-4671-a706-948e792d4dc1", "comment": "Malware payload (Mirai)", "value": "7995e63ce8522d96061b07e9d03412e75276c7e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061240, "uuid": "31f90c3c-f5d0-4006-bd70-64b2dfb9200a", "comment": "Malware payload (Mirai)", "value": "2a04989f184ab96767d6811f8b82f409f5a8575bad1e20cf7015e7f40f8bf288ba388ec77bb13a38efa4dc5a8a1203b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061240, "uuid": "f2a7e7a0-18e4-444b-9c8b-8a4c40bf52e9", "value": "T1E7E32A46E6408B13C4D6177AB6EF42553323AB64D3DB73059928BFB43F8679E0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061240, "uuid": "cd8228fc-40a0-4a06-b535-250894264e56", "value": "3072:NKrAEijtUeEaDTzbx8PhGWNFYX7QfK8E0LS96M/9NoMI:NmAEAnEaDTzbx8PnNE7cKH0LS4M/9GMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061240, "uuid": "d899a3d8-08e4-4a34-a119-3ed20f2490e7", "value": 155639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061240, "uuid": "120d3695-f6df-4287-a940-1afc07caa9c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061240, "uuid": "15a327ee-e29d-4f35-ba08-4edd0d640ce0", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ba245c-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050051, "uuid": "e1949ed6-7de3-45ba-a7a1-866ef52db378", "comment": "Malware payload (Mirai)", "value": "2037ab14c13b81858e0514e680104084", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050051, "uuid": "99757bb8-7713-4c70-a871-9633aa53a147", "comment": "Malware payload (Mirai)", "value": "a0d05ffad566285c3db11d6cb61cfd1cf6963ae0f85e6c91665fa0a1a99c45a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050051, "uuid": "6491f4ad-f7a7-4459-9eb0-4284141f0707", "comment": "Malware payload (Mirai)", "value": "726203e625590ad8fc4fe5e22408dc3e3a30cf6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050051, "uuid": "4d4f3fd6-9899-4401-ac71-04969566cdc7", "comment": "Malware payload (Mirai)", "value": "66b28af7b66b0f716d91c3d03bc2241f3e1807d2f208dae7cb29bf71abd0d295a7a121ebc418332fe8284b7f1188bc29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050051, "uuid": "96f480ed-4025-4c64-b4d0-5f4eae500efc", "value": "T10103F2AEFC8157CED1CC61BA6DEB384DB8004515A13454E7BAC0213B7AF2B32229E1C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050051, "uuid": "cc091a05-2e3d-4135-80f3-13f83ff9b94c", "value": "768:fV3j7GeG72sBKK9oAg9B9VPIlKv2gXHSVuGCKH0PnbcuyD7UHQRjC:Fj7GeG7VY9xxr2iHSVuPKUPnouy8Hy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050051, "uuid": "95a692da-47df-47fd-b29b-60b4adcea903", "value": 40536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050051, "uuid": "ae53be09-2b41-433f-8431-7645df89f0c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050051, "uuid": "c9d3d568-9c8e-43aa-bad4-b79cd4cfab34", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3442d5d9-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006127, "uuid": "eb76cc90-8ab0-4b5c-a9c7-6a538497ef7e", "comment": "Malware payload (Mirai)", "value": "1103d19cad05e9e2b6e75541ccd413a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006127, "uuid": "3ee621d7-9fe9-4774-aafc-127b1256ed71", "comment": "Malware payload (Mirai)", "value": "a1729fd8355e6f08ce5755e64a71c02b4e512ca451888b6417bc9957080ff4b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006127, "uuid": "f64a2d06-f187-4d71-bf0d-9cdcf697bf08", "comment": "Malware payload (Mirai)", "value": "41522f3f25b219be9a4a749a7fdb81065a0adecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006127, "uuid": "642fca6a-bd74-4a8c-a39d-c0aee72b2220", "comment": "Malware payload (Mirai)", "value": "e35589315fe335ee2f26a9d394e01ce63c64778fa5f9b149fd610912a72081fa599a4b1f24fec8ed92c47fa621485003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006127, "uuid": "099bc804-205a-4e98-89ad-2107aea2bd15", "value": "T1B43110436087F872E71204BBA5A15F2B67788CF66072FF0A8FA08C11FC352C4D5216B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006127, "uuid": "175a90ac-7839-470d-acd1-790ad7af4337", "value": "24:FlJq2zk0exk+6ahlKZFViZgfEev3idSGZ8/Y/CeVWsNlzxHySuluoFRVacfNf1:fJyO1aLcFVkKEciSPY/5oizxSSu0gRks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006127, "uuid": "41e96e7a-5c84-4290-9d93-7e5ad95661d6", "value": 1452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006127, "uuid": "e168f822-1d36-4472-b590-7d5097915773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006127, "uuid": "d406ccf7-6e0e-421a-b2a4-21e521641d73", "value": "dlr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ff100d-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050066, "uuid": "364b45e8-68f5-4489-8721-e15aa7c3f3ef", "comment": "Malware payload (Mirai)", "value": "fab1225e5446c0c1638759d3870ae62f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050066, "uuid": "29dee270-edcf-4273-95b6-e3f2c9cc6b00", "comment": "Malware payload (Mirai)", "value": "a2742a54c5dca82f885fbbf10b07e1f8cee8fe03acb1df53aa50b13af0cd0091", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050066, "uuid": "94997e4a-cbe6-4078-a9b5-2a977ac3d272", "comment": "Malware payload (Mirai)", "value": "a86dbcf0d1e3af26f0739fee79f671bf9ccdd88b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050066, "uuid": "2a292b43-c36a-406d-8380-cff7c0f07784", "comment": "Malware payload (Mirai)", "value": "2e589e9fbc14f942c7d4e58cc9ba055700f35c0695e7e391bfff82b704d3916c653f1cc528447f81e3068f451e4bd3ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050066, "uuid": "70701363-53aa-4cb8-a68c-b2d8954d2d69", "value": "T1A6936B22F979193BC8C4A57662F30362F2F6438B24E89A1F7D710D8DAF6465022677F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050066, "uuid": "cb2dc2c4-1d7f-4273-b465-173d9af10187", "value": "1536:O2CL9J+a9MCvR3OOSIp86P182ADtoiJq57zAZwralt39dBY:9QNO0mGiJ67sZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050066, "uuid": "581f17cc-a368-4dae-9b0d-410c2477c776", "value": 94944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050066, "uuid": "aece752e-188e-455c-8b15-f798cf7ece79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050066, "uuid": "8c317504-8073-4d90-8ef4-2ceb1e5b394d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc38e24-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048932, "uuid": "1d5777db-4414-4388-aebd-05d13b9305aa", "comment": "Malware payload (Mirai)", "value": "7c5430825666930608f2675cb9da6372", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048932, "uuid": "5c06f0c4-c606-4409-80e8-038d64e93947", "comment": "Malware payload (Mirai)", "value": "a42e07c32e61a73e34a9823a7aaa9d90ad2dc92d6a65efaf225cdeafa88ee916", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048932, "uuid": "bd3d89ac-8b4f-4bcc-85da-f1656fe74fca", "comment": "Malware payload (Mirai)", "value": "0d32df4ddf9e45c108bbb3d82639c47906dc903c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048932, "uuid": "8b8ac38d-563d-4a84-bf06-c764b959c91c", "comment": "Malware payload (Mirai)", "value": "2a11547bde8ae8ab95df23b7490217a0ae687bdb412287b9da0f941ea5932c63f4bee8b9acf3844a11a097882493c60c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048932, "uuid": "93d912fc-26ac-4621-a7b0-bc1d278fdc74", "value": "T11993E551BC82562BC6E423BAF6BE668D336577E4D2CF722BC8214B117B8551F0D63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048932, "uuid": "3df7a8a6-cff4-4ab0-b675-fc2ad933bdf9", "value": "1536:pd+dGSq/lv/d7rMbIG4WetuLadxi0cbrT9KM5cZiw+bYQd:f+dY/lub6Y0WcZi9xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048932, "uuid": "db7503d8-4889-4391-83e4-bd4b4bd04d28", "value": 93792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048932, "uuid": "2b6e7956-40f4-4c4d-b13d-4d7e20ac642e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048932, "uuid": "cdf0b282-7ae8-421d-b45f-beeb2e003b18", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1793de-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038653, "uuid": "9bb88e2d-c80e-4e1d-8d1b-fbfd2472a9aa", "comment": "Malware payload (Mirai)", "value": "f6c52d9b74d5f9963e8980248b16d675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038653, "uuid": "13fbfb73-56cf-4583-be59-c286895c8654", "comment": "Malware payload (Mirai)", "value": "a491e49f10dec69706aa9e3431b37d0756658d91f51e9b5d78f9a910a879d8bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038653, "uuid": "58f76b64-cae0-4b5c-bc03-b8f8c3c854a7", "comment": "Malware payload (Mirai)", "value": "e27d9a46fe0bf2f5894d27a60460981d00d490ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038653, "uuid": "2d985e45-43fb-40b8-812a-69aec0e473fb", "comment": "Malware payload (Mirai)", "value": "00f9909db31b405c54f67df700a332854d634a7c21032bd44f481a78cdcbc2fae809d93e36d2949fe5501a4af0ba9b83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038653, "uuid": "747ee8a0-edf0-4805-9603-5437315cdcbb", "value": "T1A7835BEAF800CE6DF85EDABB0C134B4DE171F3751A430F369B93BDA7A9250582916D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038653, "uuid": "0b413537-c6d1-417c-b438-a71313e96c19", "value": "1536:ZPlrIoEKHGcjsUCmpDw26NT8w1autw59B8YOfQeuacWjcW0JcWcB/LAYd8Bi+hif:ZPlr5HGctzDw26zBtVfQeuacWjcW0Jc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038653, "uuid": "24f4fe72-b614-4d1f-95a9-4e60c1c8173e", "value": 87804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038653, "uuid": "c7a31b97-d139-493f-a56e-c74b9e709208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038653, "uuid": "6eb9a121-358d-4765-977c-3b8667d709b9", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4a5bee-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003131, "uuid": "41ff0b63-b1a1-4748-b3a8-f8a492243487", "comment": "Malware payload (Mirai)", "value": "5bf35d274031a262cf7d8c17ca6f0e85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003131, "uuid": "f7483414-7438-44a2-9955-ed6d71979de6", "comment": "Malware payload (Mirai)", "value": "a4fc981669192154eca3bdfcb96960dfaa382c15d74985ce70a92593db4573a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003131, "uuid": "fb8465b8-46c9-48a0-b255-34dbe6d43518", "comment": "Malware payload (Mirai)", "value": "0b90cb96b4286ec3f93c809da83737562613a6a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003131, "uuid": "6c1a87e9-3f70-438e-b4ef-a254a9e740f6", "comment": "Malware payload (Mirai)", "value": "c99ee4e89b563d070a1d9195dffdcae14de0c96a0eab839f6e65c970cd05dd899493c4365c4f48d37f1629d11b6931ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003131, "uuid": "8e2b5330-9bc5-403f-a510-ad234c0582fc", "value": "T177C34B222A391B27C0E5E53640F7973AB3F65B892E65C20F7E155E8CBB197E021473B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003131, "uuid": "7845ed52-e1a5-4f6a-ba30-29c49e255908", "value": "1536:PicnW7t33jaF7viGy8mGVGsZIeNdLgHU/KBb6XrwvfS0jMVX1I4WFzx5Rn7+:6D87qfMQsZ/nyBmX0vxMl1Ipi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003131, "uuid": "9e24fff2-2f75-4e75-937a-382261b74f3a", "value": 122435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003131, "uuid": "19a1b27a-3dba-4694-84f7-19188eb4363b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003131, "uuid": "538c78cb-979f-48cf-8392-ddbe92cb358f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ca22fd-d290-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765017886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017886, "uuid": "21df2f66-c6d0-430a-9336-e2286fb5a205", "comment": "Malware payload (AgentTesla)", "value": "e2c754f8481d065823d796fcca379997", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017886, "uuid": "faa8ac6c-8ca8-438b-9db4-03f82f6649df", "comment": "Malware payload (AgentTesla)", "value": "a50c42f3b7a0d0b5d32d6659e5714e3eb108e710693038ab083de8a40986010e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017886, "uuid": "db025140-3448-438f-ad07-c663b2112369", "comment": "Malware payload (AgentTesla)", "value": "82d28d0c90b93e8df05726dd44fa60cbf88b11e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017886, "uuid": "31b88903-17fb-42a4-9be1-f174175432fd", "comment": "Malware payload (AgentTesla)", "value": "96bc0a7b44a71c7fc099ede9498fb23139b964c0aa041b16b3f28d8dea0eb627c197a7fc02e919ada9f10dc87aece6c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017886, "uuid": "bac01873-83bd-46fb-a6cc-f002f093c28d", "value": "T1CE45BE027391C062FFAB95334B5AF6215BBC79260123E61F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017886, "uuid": "13dd108c-ecf9-43b8-bbd0-297828c14eab", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017886, "uuid": "f76f3491-5998-442d-91f6-8f43304b312c", "value": "24576:+5EmXFtKaL4/oFe5T9yyXYfP1ijXdaKms/zfNc0DgfK4Xxok:+PVt/LZeJbInQRaKmsbfNcgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017886, "uuid": "0e6e4cbe-17e5-49d9-ad33-351368878ee6", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017886, "uuid": "5d4739b4-a252-4678-9b10-ab510761d46d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017886, "uuid": "4e85b95d-18ff-45c2-b412-efa7ab8ece18", "value": "CGDD016760 Guoxiang - Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b225c46-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049169, "uuid": "1139fafc-0664-43e7-8739-1bd3b9721202", "comment": "Malware payload (Mirai)", "value": "168fba54f4ff2b8be05d593a979c2ff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049169, "uuid": "9a73fdf6-3227-46fa-98b9-069147b9470b", "comment": "Malware payload (Mirai)", "value": "a539e2354a9aa70d1052f5e814904a332625b06954becb94db7e110573f7754b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049169, "uuid": "4cc9f294-cbd3-49da-b0ef-d8013c60d638", "comment": "Malware payload (Mirai)", "value": "b2a5e0a5b15ba5503a346c7674f6e794ce983346", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049169, "uuid": "c5f21931-42ee-4f16-84f6-8ad314f8b35c", "comment": "Malware payload (Mirai)", "value": "12a00402223587bf5940798b03db27e8a855f2bb547b3f47863e410cbc565f123bda27635edf8952f9d701599ad24759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049169, "uuid": "1ff02929-214c-430f-a45f-2134214d2932", "value": "T11F335BC5AB93DCF4EC1546712177EB328B77F03AA12ADAC7D3899523AC42B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049169, "uuid": "3bd7b486-d337-49c4-9e71-222aa0e82a70", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNZHSqMQxpwBNbr/J:xZebkP/Ad39UMJRlhNFSDQbIbDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049169, "uuid": "b9426390-0424-46cb-aa5e-4220cfcbde97", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049169, "uuid": "ff4a8888-546f-480c-ab2b-6d53c5f2a1d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049169, "uuid": "ceb68e6c-a9eb-430f-a327-c61444545f8c", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e24445f-d2d6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765047832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047832, "uuid": "66a42f03-3cbb-445b-a5fe-9811ecae2cc1", "comment": "Malware payload", "value": "3151b934f1f285211af6d4c816881900", "object_relation": "md5", "Tag": [ { "name": "datareportnew-s3-ap-northeast-2-amazonaws-com", "colour": "#D14540", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io", "colour": "#5EA0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047832, "uuid": "63033b06-266c-4bfe-9f9b-b566d2610a64", "comment": "Malware payload", "value": "a5c1d5331261580c14513f04eeeecc04a5169ac69b3c24e531c9e08926b55981", "object_relation": "sha256", "Tag": [ { "name": "datareportnew-s3-ap-northeast-2-amazonaws-com", "colour": "#D14540", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io", "colour": "#5EA0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047832, "uuid": "034fd291-b96f-4760-bc7b-0a4f4451fd0d", "comment": "Malware payload", "value": "28f84751829a706b2cd7fd0c80242062a92e3f25", "object_relation": "sha1", "Tag": [ { "name": "datareportnew-s3-ap-northeast-2-amazonaws-com", "colour": "#D14540", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io", "colour": "#5EA0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047832, "uuid": "4d007f2a-56a5-45bf-9b55-934cacb2e550", "comment": "Malware payload", "value": "e64e4a044d08641cc59ed5b6e0adff6778a4591b8c82f866d27bc1bb816e52b76b71dd57245b0dbc317c5ac33016ac75", "object_relation": "sha3-384", "Tag": [ { "name": "datareportnew-s3-ap-northeast-2-amazonaws-com", "colour": "#D14540", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io", "colour": "#5EA0D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047832, "uuid": "9656be06-6cad-42fe-8207-e2b45ad84503", "value": "T1FD93E81266028420F7590B706925FAF449AAAE3C5BD0F1CFF278BE3A69712C3597714F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047832, "uuid": "b8b77019-ebfe-4cb1-a85b-7e6caa09d97e", "value": "1e3da40150848dac677491486b03a068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047832, "uuid": "6e90fd0f-d742-4259-a92a-639b065f83af", "value": "768:/9uLB6XJydIoqEEV/92xXuYsnlZLck/V0S6P1//zA1XfXvb0xtAhhZU9QZU9JbYM:FuoXg1R7slZP/mSk+XwxohzEb7OxG6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765047832, "uuid": "a071ea40-e001-49f9-a09f-27bae2640dec", "value": 96360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765047832, "uuid": "931cfd13-972a-4f42-8637-90646b41d083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047832, "uuid": "c6d9aa4b-a7ff-401e-b4f6-419ff661e928", "value": "DataReport.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b416503c-d247-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764986585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986585, "uuid": "70490d65-799c-4174-b701-56aae2f442ba", "comment": "Malware payload (Mirai)", "value": "48c3ea7686ad8035490bb6110616cd32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986585, "uuid": "87b15074-175d-47e4-864b-e21630160704", "comment": "Malware payload (Mirai)", "value": "a605a70d031577c83c093803d11ec7c1e29d2ad530f8e95d9a729c3818c7050d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986585, "uuid": "eb85e7cb-6b54-4c95-9b55-0421816ef705", "comment": "Malware payload (Mirai)", "value": "7fe3826fc7b90e20c9fe76a7891eff350d73b6b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986585, "uuid": "6c69d9eb-158a-4a18-8ba6-5f68377db254", "comment": "Malware payload (Mirai)", "value": "e813d9c81b4d150f4ad9ecc50065759530ccd6c1cd5fde61ed00e0dee6262b2b8b5868150d13bfc67ec9238dde4c2b90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986585, "uuid": "fcd49585-ab5c-48cc-9f02-fd8d90a4a4da", "value": "T1EE746C03EBC160FDC0E5C0324B8F9336B732F49551297A4B27942E69AE76E514F2DB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986585, "uuid": "43a425e3-dee0-43b1-b930-75d41405a598", "value": "6144:xGSUgbqfIfuc6AVCzUnOTbEhO27mp6G8zJC6nRcRb:xG9gmfIf1DVCzFTbEM2q2YR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764986585, "uuid": "d4b6ded5-dbb0-451b-b073-825fac43043e", "value": 345656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764986585, "uuid": "21e079e7-5f37-475a-975b-4635e872e278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986585, "uuid": "d10da35a-893e-498a-a1a6-6094409f30cf", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923264be-d2fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765063837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063837, "uuid": "194cab83-ca23-4b30-aa2c-35acf170b65b", "comment": "Malware payload (Mirai)", "value": "accfe43143794d228a6fd64678710e66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063837, "uuid": "bcdb099d-f678-4677-95bc-9da72555a2f3", "comment": "Malware payload (Mirai)", "value": "a6af14d85e602b793af279c026ff8fe21da1882c11a015f6f23a731c9725d95b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063837, "uuid": "d11c6536-6eaa-4b8d-9a46-694a5ddb039e", "comment": "Malware payload (Mirai)", "value": "e8f48828a20e8fdea5f57035322f50afab7c2ade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063837, "uuid": "efbba876-4ff9-47fa-b072-242c8ada87f5", "comment": "Malware payload (Mirai)", "value": "e4e1ba947e9a01f7c05b9c51eabcf3626e535d1f67aeb94deb62c975094a2f6b4e38918bc98751ad26820c769d7f104a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063837, "uuid": "2940e3df-09df-4cef-a6c3-5e26338b10d7", "value": "T1FF535C17A94180FCC49AC2344BBBB639D923757E1338B2B92BD4FE276EC9E601E5D504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063837, "uuid": "f0da6324-656c-49a4-ba95-30def7d8451e", "value": "1536:eLBifdZBqhW/sXzi2lpan0uAyT6oJ7ZYbmmt3WEcnut3yap:0SLchW/sXm23a0ux6oQ1t3Wdut3yap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765063837, "uuid": "616867b2-b4b6-4ff6-8eb5-ab0643026d36", "value": 61168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765063837, "uuid": "4bcdc2e1-e847-4c54-af94-b2799169fce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063837, "uuid": "5a96cf0c-b76b-44fe-bad5-6df1f90d0593", "value": "fent.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fa22c0-d28f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765017562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017562, "uuid": "d34a44b9-7b54-4a1d-8669-faa29ea61627", "comment": "Malware payload (Mirai)", "value": "4be6ee45a466d43bfde2b46f3b8c22bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017562, "uuid": "ec86f4ed-30dd-49d1-9b03-7bf9d543507b", "comment": "Malware payload (Mirai)", "value": "a71e230548a83d08081e06f96e7f6d1dacf147e90945f92dd9badf712083c828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017562, "uuid": "7b855e01-2cc7-4481-988c-d9f1a2dfb460", "comment": "Malware payload (Mirai)", "value": "6712331c9ae926ccb60de0575548a1ce9cedbb4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017562, "uuid": "6f9ed467-9fee-4e11-a89b-af4af50cb53a", "comment": "Malware payload (Mirai)", "value": "106cf486a0206acb38fd49634f12c86c7b194cf97e600e029514a1a55bb87b87c4c1b4b60fad531a2df14a67a1be9987", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017562, "uuid": "efba74d0-b48f-4db7-9558-ad776692e53a", "value": "T1B5B34BC5F653D8F5ED0706302176FB37AD72D1BA2328DA83D3A89A727C11A42D41AB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017562, "uuid": "b7f8d646-d9ca-4aa3-a9f9-ffc0d302ec73", "value": "1536:Ywfmf+dsd6GSaFv2QY8nWWl16ebIbeG2ITXAabK8uGlNBbhf833SaF+aCr6Bf:q46FNHnWWqeEzA8KXGPNhAF+aCeBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017562, "uuid": "c05aaa02-f6a4-4bad-98ed-77879172ba15", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017562, "uuid": "6fda8425-8de7-4fc2-b778-71a4f1201bdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017562, "uuid": "5bd8004b-aee4-4330-9127-7efac18a73d4", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14652c1e-d29e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765023683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023683, "uuid": "c2cb1b3f-9dfc-4948-9acb-016fa0c7a357", "comment": "Malware payload (Formbook)", "value": "73fd596dec5e845746a1ba409e1c5a12", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023683, "uuid": "14954ca0-ab6b-42dc-b8b0-7802fb82687a", "comment": "Malware payload (Formbook)", "value": "a7e50bd406aa6d6ff875eeb896d4d64893ef35347405e88daaeef02a6c167095", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023683, "uuid": "d2c43df4-9bf1-40c2-814b-03648f325345", "comment": "Malware payload (Formbook)", "value": "4047df1c3e437609a7873a46feae51773abdf147", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023683, "uuid": "f3d77ee4-863e-49e2-b207-1b756bf33630", "comment": "Malware payload (Formbook)", "value": "c0b33c3b5622007cdd2bbda032f584016bd34ad719f30b1c7b027a008c891acc457679b09aeec3903a274a7bf0b70fe5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023683, "uuid": "47509197-9fda-4f42-ab4c-205d4780dc43", "value": "T1FDD423FF06A3A41C757A4B43D9F7AA219719CC044B98CE5BB0E2CB2D13E0762D98705B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023683, "uuid": "9a673ea2-4772-479b-af18-d09827bb94b5", "value": "12288:ymaJrOPNqtIHUmio1OZcF8E16R2Mb8o78V87ad2hKGv3jq0:crwNUIHUmf1OsT16gYL78V87abM3jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765023683, "uuid": "00eeb69a-6f91-415e-8107-f42cfeb2028c", "value": 613798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765023683, "uuid": "86eb63f5-c848-4050-ba62-a6fe1e3325bc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023683, "uuid": "8d57e8d0-0de6-4d69-9adc-b1ec5d414733", "value": "quote.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d908784-d2f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765062890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062890, "uuid": "502b804c-63bb-41bd-9323-49eddf1e62b6", "comment": "Malware payload", "value": "78257ad2b6b1f61146810b0a1571d9fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062890, "uuid": "a8c7fff8-21a4-4b7e-a921-fa93c079d487", "comment": "Malware payload", "value": "a7ea049a849476ec145d3f591d25865737aaa3bb42417f0c03dc9965bee07044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062890, "uuid": "3a3194f1-9682-413b-bb19-27b05d86bfa0", "comment": "Malware payload", "value": "0ec415c6e59825372cbe91ed5845b8adc7262150", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062890, "uuid": "fe5ef7df-006d-4161-9f6a-6cd28986b376", "comment": "Malware payload", "value": "ab6b657ce15fb3e508020794687121ad341c88527b06b23f0ce3316a546aad4dac9ff3d6b783ec7ea2c63706899619f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062890, "uuid": "5e47a763-b2c1-432f-855a-1c0f89c4015e", "value": "T1F3D2E0847A15EF52F7110473295CAA9C4EBBE79A0BBB30728CE5EE8DC34515B188F385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062890, "uuid": "f672698e-188d-4361-849f-022cc78c758e", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4kjNBrHKuxTnxl/KEuBmsk0:pwkyTc9pHiGJ7bLxlpuYPW55oXnO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765062890, "uuid": "feae5f46-66a3-4cc1-9d5f-d869e744aad3", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765062890, "uuid": "f4b15411-5360-4468-9534-93a9e065a930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062890, "uuid": "54b0c6d5-a949-4a83-bd0f-09705c4eb17f", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3901c342-d25f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764996686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996686, "uuid": "a5d5092b-1289-40b5-870c-af45aa6b2986", "comment": "Malware payload (Mirai)", "value": "7d9bb64e917cf9f5344b2276c97618f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996686, "uuid": "f595c54c-5a2b-4407-a2e4-e4734d819176", "comment": "Malware payload (Mirai)", "value": "a85c6a42523fb3c3db44bb5765ff4a708974019829e8cdf37b8dabd011545749", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996686, "uuid": "b0ed0b77-09b8-4323-8594-c03408e01b1f", "comment": "Malware payload (Mirai)", "value": "b8f22ff0158dc0bc73c98e28560a9e5f37dc9928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996686, "uuid": "6c18d2f2-9cdc-4fe3-936e-372a655ab1a9", "comment": "Malware payload (Mirai)", "value": "ce85214128a2569c828640e9d5f25cf57437dce0ab879b71b3d722892af464073f155981dad10cc13d8f72662d4f1060", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996686, "uuid": "93043aca-b439-4273-acf7-bb9e0ac57a0f", "value": "T17F140905E9144F67C2D22BBAF78E429D37372B5897D73302A938BEB02F8679D1D29110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996686, "uuid": "741e6ddf-3658-4e47-9082-f61c6f782332", "value": "6144:iE87c4wHdcfmLNMypmsGXLJZZ3pS27+TJhbl:i3c4EBBlmsGXLJZ1pS27+TJhbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764996686, "uuid": "87840613-7fd2-4783-b270-fec1476d5475", "value": 201476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764996686, "uuid": "b9be1255-574a-48c9-af0c-d14718d756a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996686, "uuid": "08f8f6a6-08d9-4c57-b036-e6c67dd93586", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2401516a-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043466, "uuid": "47d7e45f-6644-43a1-81ac-39936a17cef2", "comment": "Malware payload (Mirai)", "value": "e959b9d69050cd4cd2e54e8eedf73401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043466, "uuid": "5f970f47-09e2-4200-8d61-7fa15036586d", "comment": "Malware payload (Mirai)", "value": "a8cd064d29f2e7244df6239c383a91c4f880379611642551bc352ab03e5e716f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043466, "uuid": "685681dd-fffd-4dd1-bd10-065b14e9cc98", "comment": "Malware payload (Mirai)", "value": "3095523209fed6b9eacfa767377bb2da3377c0a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043466, "uuid": "8e771648-a4e3-4c51-81f8-fac1a8a7afee", "comment": "Malware payload (Mirai)", "value": "857622934cf247ee3619c52ae3c80a786662cc0313432c0f0c8d85c5714d2a8dd2d59ace3ff3e4a23d76af569e84a714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043466, "uuid": "0a2cb7eb-6c33-4cfa-8f72-9670aa3a635a", "value": "T1727329DBF800DD7DF80ED77B44530A0AB270A79106931B36635BBA67FD321A55822F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043466, "uuid": "9f18289d-a6db-420f-a88c-c9514117f50c", "value": "1536:z3OL3wr34Qu3EhvOy0sxomrC9iFH4ZWp6wtwb48FyRXFORZkRawHUzN6Nzbotcul:z3OL3wr34Qu3EhvOybxomro+4cp6wtw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043466, "uuid": "cb4cd876-c1b9-474c-af91-7628d6eb75bb", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043466, "uuid": "a5c45a6b-4211-4095-a93b-55623fff928b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043466, "uuid": "b4ad9c9b-2fdd-44bb-bfeb-aa380929d65a", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565484d2-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037538, "uuid": "839f3158-7b69-49f8-b499-8dcc0d421530", "comment": "Malware payload", "value": "2e4a0f4e261b7703fc853085edc19c7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037538, "uuid": "ac5f27ea-419a-4dce-bf9d-953b23c9cf35", "comment": "Malware payload", "value": "aa2bab7d76ac12a2fd565253404fc6f44cc5fdf2c3e337ce93a1ff8e7f89b009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037538, "uuid": "fe7d28ae-f753-4613-af8a-e225e338ce8a", "comment": "Malware payload", "value": "b415dba1785698d0782728e628f26b08085b33ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037538, "uuid": "639feeb3-6345-44e0-871a-b6d07bd4b257", "comment": "Malware payload", "value": "156a2bdd1821156f8c787263b1ff0f316a86dcf5acc47aed9f7ad50ec59a3c9564d00d4e2907e2c20f31b2bbf86c7a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037538, "uuid": "1911fe4a-cef8-4b10-ab65-622336f8c9ec", "value": "T1726733EE0C18BA7EE8799D7293B1B7F650BF5C8A954D6203B1B6B402147F0768013BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037538, "uuid": "1bb5c611-a761-4394-ac00-4032f74c508d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037538, "uuid": "a54bbbd0-4d6c-4f36-b046-4f16badfefe6", "value": "786432:O8yKs9cwlk+o8ct4rwKInuav9G9cbqHpLFFHHoRhuHegbM:nls9cwlk+o8S4rwXnuavuc+tFM4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037538, "uuid": "5d2ed477-92af-49c8-9371-837374212d23", "value": 32627989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037538, "uuid": "b6d746e9-759c-4432-ad2c-e8a6db3011b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037538, "uuid": "df8d82c1-2358-4ae3-b398-7bfe2a39c844", "value": "Driver.Booster.13.1.0.171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ddae52-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033829, "uuid": "ede0fa50-0484-457c-b315-1567edb81483", "comment": "Malware payload (Mirai)", "value": "a4d9c8df7f662e93e18bb46177e8a4f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033829, "uuid": "35c0fa25-55fd-4c89-b40d-dec5c2f3f4db", "comment": "Malware payload (Mirai)", "value": "aa8ae5c317cddc0cc59dfc7094978650f27877781086dcdc4abd063c5727c58a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033829, "uuid": "bca3bed1-32b8-40b7-8aee-e5d4f695a92a", "comment": "Malware payload (Mirai)", "value": "a1462b0260ab664dd213cdbcaa2f96d9373a779a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033829, "uuid": "c15ef5f7-3381-4aae-8f65-8f81454b5813", "comment": "Malware payload (Mirai)", "value": "311c8c3920a526c75730245409277cf4c8a76096aa55c8829c37dcb619a9f26e8d2725807b2fb354be631010a2b81715", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033829, "uuid": "5a771402-d819-4a2c-99dd-e17486ee4d05", "value": "T1E7C2E17DC2656EB24B650CF4ED31D8861D2DD330A4BA34F3AC3681D816E464BA7A57C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033829, "uuid": "cff22318-8231-4990-8b84-77e2670769e9", "value": "768:S9xM13LhiMUsg5iFZOVTUzp7KOe09q3UELJTl:S2hhNg0FUTqp+OedL5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033829, "uuid": "3b2f0c74-ff7a-45ab-8963-054e6fc13788", "value": 27452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033829, "uuid": "7156d378-2783-42e5-b369-b8b1c5082149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033829, "uuid": "9a771014-062f-4711-be75-a7acef56d246", "value": "b3astmode.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe9cc5a-d290-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765017951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017951, "uuid": "37b31165-ec23-44b0-9eb8-c6b619b85feb", "comment": "Malware payload (AgentTesla)", "value": "b42329a816cab7423020d03fade2e479", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017951, "uuid": "f581c320-97fa-485a-b6d9-7e69772a647c", "comment": "Malware payload (AgentTesla)", "value": "abb9f2c2b17f9cd30ef7e8d0fac1083bf042dad7dea45629a24c5922ae482e6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017951, "uuid": "76eda512-3563-49c6-8af7-84b042a48968", "comment": "Malware payload (AgentTesla)", "value": "d6c45c0655df27549a8675a71fbae6ccff271c9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017951, "uuid": "1cb832bc-8baa-43ed-8a53-0af0d245bdc0", "comment": "Malware payload (AgentTesla)", "value": "4f9a3bb5ac96cbb0bdf48e76bda25d88bb3b1f34acb2caa429267ff2e8cb430b371b0638223c8b3db32fb006b67c15fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017951, "uuid": "90024f38-8b41-4817-aed0-ab69653b612c", "value": "T14B45BF027391C062FFAB91334B5AF6115BBC79660123A62F13981DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017951, "uuid": "29c94011-1169-4bc2-a7b7-9cc90eb123c3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017951, "uuid": "7788c69b-0dce-4836-9066-d2ff095171ba", "value": "24576:35EmXFtKaL4/oFe5T9yyXYfP1ijXdaZLuCkCshXPdTJRdfSSQVys:3PVt/LZeJbInQRaZqCkVXPpJRR/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017951, "uuid": "40dd3dcb-eae4-4029-ad14-e405badc5378", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017951, "uuid": "2ff440b0-813b-4c50-89ff-798964171861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017951, "uuid": "a00f1feb-8e42-4d17-8bf2-266cb927d348", "value": "PO.1174325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011a83ab-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765048562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048562, "uuid": "d61a7de4-9896-4260-a8a8-71052c3e95f7", "comment": "Malware payload", "value": "4ac7bd4ba41ff24919e0e5974b9d5eda", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048562, "uuid": "fd960b92-0f31-470b-8466-63728e049153", "comment": "Malware payload", "value": "ac32d9ec7af0c9f1a2ac734b46d34e12ece371c9d4e3d3fc9e301b16f790968e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048562, "uuid": "f2639cd9-bbfc-438d-bf2c-1b0fd205d4af", "comment": "Malware payload", "value": "5a198c9766e81757c59332ec5250a3fec85f159e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048562, "uuid": "321a39ba-81ad-4155-aef9-db89a5df93c1", "comment": "Malware payload", "value": "2500c2c81375d48c1f954c12dec6699b2d539c7dd03ef219e4780d8407786376673df25564fd81cd6d9a9b3639cbe568", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048562, "uuid": "ef55f228-b4ca-405c-b5af-36d73b0ae31c", "value": "T182C533CB3BD02929CEBC7077D5459CE1996B9CCE9A87D3079405A2BA35D73849C8EB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048562, "uuid": "20ab9999-f63c-4db9-8b02-dca1aaca0dee", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048562, "uuid": "52f31daf-10ac-4f03-aaa2-1c3bab22f347", "value": "49152:CAOth2Z45pUsH1vcOtDZMAf3Mk6ZE09zmlX2cMBPo+skWFJzpFtiikXDGIz:CHtAZ45pHv1tW0M5E2zmlXhOW/zpaTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048562, "uuid": "5d5a18fd-d26f-425c-9f2a-a7df9c8c91c1", "value": 2720256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048562, "uuid": "23f233bd-69b6-44e6-b1d9-ca8da0ddd372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048562, "uuid": "b4b30a80-21ae-4304-ad47-d30f67e7d1bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0516bf7b-d252-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764991016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764991016, "uuid": "f3f00ddd-1eb8-4b28-8e3f-1d13f1ab8593", "comment": "Malware payload (QuasarRAT)", "value": "28876fa9ba2f8bd6a0adfd0ee09968e3", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764991016, "uuid": "0f0acf82-da07-490e-a529-d28556209045", "comment": "Malware payload (QuasarRAT)", "value": "ac631ad518856b80393ddf23bfea4d37a56382239bffb66d8093e447751d1764", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764991016, "uuid": "e6c74bf8-157b-4dd0-9f96-64448a2d015b", "comment": "Malware payload (QuasarRAT)", "value": "999096e65ef19449436fb01314ddee1374b7798e", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764991016, "uuid": "29366417-ca6c-4a9c-9c3e-20fb0e2c8671", "comment": "Malware payload (QuasarRAT)", "value": "3f4878b972165bc8d6f48d5b1ffe2d6f90cf6aca5275e49a226347f3ad3507594f10cf407c015434b22fe0368aa492bc", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764991016, "uuid": "eeeea59c-ad83-48f2-a372-d4b54099cfa6", "value": "T18FE55A143BF85E32E16BE6B3D5B0501663F1F82AF363EB1B2181667E1C53B505C426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764991016, "uuid": "d32816f2-0fc7-4a97-8a5c-4586d9dfaa33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764991016, "uuid": "e2079a0c-a0de-4987-b72a-dd9edfba26ab", "value": "49152:fveG42pda6D+/PjlLOlg6yQipVV6zO7hzvJhKoGdbTHHB72eh2NT:fv542pda6D+/PjlLOlZyQipVZha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764991016, "uuid": "8986860b-10f4-4cab-8466-acd6b83acca2", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764991016, "uuid": "c8d6f785-a41f-4220-ba45-4b47a5107109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764991016, "uuid": "d04326ca-7b13-4132-a658-e2a7a94b3586", "value": "Windows10Upgrade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c23c0eb-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042191, "uuid": "5ad387f5-0c1c-4bf8-baa9-58baa65c381d", "comment": "Malware payload", "value": "8986ffe62ca8240d895e4279a619f636", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042191, "uuid": "3a8c7fa2-fb09-41c8-994f-7ff3e7490d58", "comment": "Malware payload", "value": "ac9c44a3f4bedb921c58d0182f24777f035d60f338e265a08ca18097529d1040", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042191, "uuid": "c6bf6970-cf06-464d-8a60-745921d1aad9", "comment": "Malware payload", "value": "44e9a8ac799071a564362d3d379ea56fa60782e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042191, "uuid": "984c4973-92b6-4bce-a992-eacadb0d724c", "comment": "Malware payload", "value": "dacb30252e1b8d9861c635842082b28f7992889da1c31a09685500152c1ada95e46496e8181d7d6d9ac5721c3772c9e6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042191, "uuid": "256ce15b-e801-4be0-b65d-09e806fef16d", "value": "T1CCE47B61B2B4613CC05F90BA97629321AB33F61B631467FB72AD92781F83D915F4B60C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042191, "uuid": "7ecf1b0f-75a9-4b8a-b900-120d5b361792", "value": "c605237924cd6de13cb33ab8772994bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042191, "uuid": "d9daccf3-de66-474e-b397-8c467871381c", "value": "12288:Fq642cCExTBnLCJNqmWJM66VdJQJLLBnkEVlzoDyWythvZJT3CqQrhryf65NRPaz:I642cCmBnLCMStcGSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042191, "uuid": "27c0cf46-f594-412d-9564-dcf2791f89c8", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042191, "uuid": "64a30892-e1d2-4b88-ae1b-007d231cce6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042191, "uuid": "ffa4c543-2739-4cdd-b963-a21539b45756", "value": "dkom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c1d03b-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042268, "uuid": "4d19b49e-48db-494e-9574-fcdcbcc45148", "comment": "Malware payload", "value": "9607fcecf465e9bf2679cce377eec01f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042268, "uuid": "ce0c46bc-3b51-40da-b32f-79c7918ae8ec", "comment": "Malware payload", "value": "ad75caddf17f24472c753f1d5fff7fa8ed8a95ce7aad82e6bca8d6bc1ff813d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042268, "uuid": "fd7cefce-0481-48c6-aa45-b20ea51a3f1e", "comment": "Malware payload", "value": "685e38d29a732bd497739a9edc17be4f96a22132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042268, "uuid": "191772e7-f2c0-467a-bd4e-226edc1a4d77", "comment": "Malware payload", "value": "121d5ec38fd3ffc849337cebfb1c83afae52a2c5a54cd6c64e8edcc06ef346fe3f2c25775354d6c4439164f0218acf14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042268, "uuid": "efcaa726-b383-439f-b1d3-ab317fdaac78", "value": "T165865B03ECA255E9C0AED23086629263BA717C485B3167D72B90F7392F76FD06E79710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042268, "uuid": "33697cac-6766-45aa-abf8-4f30256e3bca", "value": "eb4bc58af92786a7bfc5380df276273e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042268, "uuid": "d45de099-cc05-4f8e-9f38-ed075b0756fa", "value": "98304:OiBkPD4UQLYKuStxulqFfV2EDcUDGDNJgH:OikDhQL0STNjDcBJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042268, "uuid": "6b0d2e94-862f-41ea-beda-d30d38c68a86", "value": 8093696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042268, "uuid": "116b666a-d6c6-4c5b-ace4-ccc624460428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042268, "uuid": "741d4222-2aa9-4a20-b73f-58251433330d", "value": "steal_browser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81578414-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050065, "uuid": "1c5e9cfd-136b-4e2b-8dbe-b254b650b3aa", "comment": "Malware payload (Mirai)", "value": "428cd8dc7d2404f3a0a803544939389f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050065, "uuid": "990b193b-a5a1-443f-a382-ab0bd71e4854", "comment": "Malware payload (Mirai)", "value": "aead8f51378ba2cc815318f198c9b563199cba9c2f73ae153c35ea115ee42728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050065, "uuid": "17223348-2f77-4b7b-bea6-5adcc63244ae", "comment": "Malware payload (Mirai)", "value": "94a76b1b4e905e454615d12c27008ba8f8a83fba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050065, "uuid": "cd6d4c5c-cf0e-483d-be1d-c9b316e72559", "comment": "Malware payload (Mirai)", "value": "a3b8a3e02f464a79da70305536d4139b55bdcdefc66e601d8948064ca9a3c4cffba3f5bfc44fde9504364052ebd29071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050065, "uuid": "9e17f7fa-920a-44d1-b48d-c98d09dedb82", "value": "T1D8A338D7F801DDBDF80ADBB744530506F671E3A219830F36626B7867ED391A85826EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050065, "uuid": "def66d0f-3851-48db-b84b-f68f811946d8", "value": "1536:2Y3pWv1r+jboscZ8RwmY1TiZagB8IxCagm+l5cmhbfDr/Z1ra1AgJ9Zq:njkwX4TiZagKR5NhLXa1AC3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050065, "uuid": "0b587224-b4c5-4fdb-9b2f-d28a121bfefe", "value": 98616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050065, "uuid": "708ab915-c80a-453d-b564-4156d38caec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050065, "uuid": "b9e07d9b-4903-4ecd-a7ed-31c47a61b5c5", "value": "nwfaiehg4ewijfgriehgirehaughrarg.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29add530-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981628, "uuid": "3e798aea-e7b7-4b78-892f-d510da1d16f1", "comment": "Malware payload (Mirai)", "value": "aa8717b19d0ed97f8d4574e475d71166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981628, "uuid": "60d8d54e-6b56-433e-aee0-f374d2eb0294", "comment": "Malware payload (Mirai)", "value": "aeec94d8ff6fae6d4b942c3d4cba2a962e25ae42948c6188fc488bb2de638d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981628, "uuid": "faed7bf6-3c66-43f4-9404-7e29643efc7b", "comment": "Malware payload (Mirai)", "value": "c96fbc3f948f86e6e33d01f55e7ccba7c2f7b2af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981628, "uuid": "d2bc52a7-e405-4780-93cc-9ebf7a157175", "comment": "Malware payload (Mirai)", "value": "99f162ff974894c3ecaf67646d137aee96ce1667bf12639c86c9d363cd5dd725cb49c4a6426c666bc0851b12067a2391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981628, "uuid": "a8651e57-ddc1-433a-9b16-b6decbe91f68", "value": "T175935D02B22C0A47E4A35DB4293F17D193BFE95020F4BA89695FDB1A8635E335486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981628, "uuid": "e58838ab-9043-47d0-9f4f-f6a2efd32ff0", "value": "1536:U7f3Kt1Th0c0sJbVLDVt5MYoJz3DBJj9QIiOT6joeFSAi2FdfkpuRBXC:U7f3Kt1Th0c0sJbVLDVt5M3t0O2Bm2F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981628, "uuid": "99dc3a63-395b-4ce0-9b51-4a98433db02f", "value": 95852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981628, "uuid": "c87711ce-e3f3-43c6-804c-20113db0dffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981628, "uuid": "4cf3f154-bb10-48c6-bdb9-bda07a4c957a", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9762d41d-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037647, "uuid": "b58d148d-2d7d-463a-b3b0-eb1a277c1ce6", "comment": "Malware payload", "value": "867a500cec870b8d3bea3ae536539c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037647, "uuid": "2fd5dabe-c3ff-4c04-8193-402f905b25b3", "comment": "Malware payload", "value": "af2f0607d25e45251e58a4a5ce6bb0d1397faa334f963cb2208529698df11c17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037647, "uuid": "aa25641d-75eb-4998-a1b9-a0e77c6d9093", "comment": "Malware payload", "value": "9c2a8902612074bdbfabbe80d7808366b71865df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037647, "uuid": "d70707ec-7c63-4c4a-995b-aa39238876d2", "comment": "Malware payload", "value": "b4248705e69499504f0763d72b592467d39ce4040fc62d36e8ed7e2404433c5c3ad42b5d17c8eb391e31a786a2a89870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037647, "uuid": "2dad562f-60c3-409f-9b8e-ef4d327d0446", "value": "T1BB721C5196E4E054F37535702771E63A225DFC6D0E33C9AA982FF2B86D3535C5C2221E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037647, "uuid": "38b77468-2176-45f0-aaca-51ce6ab42ded", "value": "1ad88f29b3f2e97e57f32b98c058b515", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037647, "uuid": "a59df145-6477-4be8-9b20-5e9647ac6ec4", "value": "192:SBxYNapkZ0+PoOMeF9wAndgMnzmE6HPmoynvXUUN4aHcdvIzZcM:+xaHZlgq9pzmXm9Xdt8dvu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037647, "uuid": "0ca0e875-bd64-4848-8403-052671163195", "value": 16848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037647, "uuid": "50662c37-3c30-4e9a-ad61-e6954b4d566a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037647, "uuid": "83fa255e-a945-4733-b8df-78fde924fadf", "value": "aria2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311a53d0-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006122, "uuid": "82ad8603-d98d-448f-9e6b-1bc1c47a2282", "comment": "Malware payload (Mirai)", "value": "999de0779ebbf14c4676abc217f08714", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006122, "uuid": "70a6e0c7-9676-4ba0-a5a7-5673305ded73", "comment": "Malware payload (Mirai)", "value": "af5832924bbc3f15f7f90a99a99b889e8b457b466488e4d705175f34c48650d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006122, "uuid": "67454cea-0fd8-4d0a-b53a-c5d351c3c77c", "comment": "Malware payload (Mirai)", "value": "1c5079340f6eeb00addd238f193b59251c7c8e1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006122, "uuid": "c5725143-fd14-404d-91bd-aa94c3e6a356", "comment": "Malware payload (Mirai)", "value": "8efbe776165ed718740d4f44dfc1209267ae72fe2a7f28c41d98d63e1c40d05965f0873f8398fd7709cec9d21bbbb023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006122, "uuid": "c39aab22-108e-4899-834b-ac4f7df97477", "value": "T19131217BF7FFBA07C8E485790C575B617163DD6C0024815A7A40A51E5C91231BE623F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006122, "uuid": "2e852d84-180a-4cda-86f6-ecdce0986db1", "value": "24:3CftLItNirb4Ry/2mLbEMu/NQKvfOxfxPCNIGFVEw15jC:ScirAq7oMmNV3fIGEcjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006122, "uuid": "c1aaef13-f5f1-467d-b91d-36beac3809f7", "value": 1472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006122, "uuid": "976ddc2e-ce55-4112-bb51-a6680f7ede53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006122, "uuid": "ba0d4d6b-3359-4eba-a247-c8818cda08d6", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664d6673-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042289, "uuid": "ed5b962c-3fd0-4365-a733-db9de9b047a3", "comment": "Malware payload", "value": "8c3133d8f17715780a7f81c640e0009b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042289, "uuid": "f8339ce6-bd11-43a3-b3c9-ea27e5c7a0ac", "comment": "Malware payload", "value": "aff8724f1323da8f678bbaffe63ca6b06b4353fb96d3ee5c2878e77d644a223b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042289, "uuid": "dd5b39a9-cb3c-42cf-9952-78fe127d17e9", "comment": "Malware payload", "value": "59b3d89379fc6f62fe3982fbf26e745e1711a8df", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042289, "uuid": "a8073390-6b87-4cee-8580-a645242b3081", "comment": "Malware payload", "value": "0d108d5d2a8f3c62335f405f527dadb66ca237416fcb4be08ff9ce4f70eee3620da42ded41c5621edc44eecd1c1292b2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042289, "uuid": "1e876e2c-6294-4a07-a6f6-f47cc17015f6", "value": "T17212506C9586191EE563015E4A95A308F833E63746CE9DC0B61C82F4BFD372D8373AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042289, "uuid": "9ac26838-9e97-4826-af17-bc3e7085c69f", "value": "192:RyR/e05oAENPfokod6XwM9YVD9Dk29sJssxZMtzlx02Jf:YBTrG0zli+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042289, "uuid": "5d9a7050-f1ee-499e-b6d2-23e2e4252456", "value": 9387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042289, "uuid": "630db313-bbe3-4fed-bfca-52b50d2aff9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042289, "uuid": "08372e89-a2ab-415e-a459-3597be781ab4", "value": "uac_bypass_multi.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a169619f-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050119, "uuid": "0bb5d399-6f2b-47a5-85c9-28df54ff6e53", "comment": "Malware payload (Mirai)", "value": "64b218eb941a6555423969ddb596a4e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050119, "uuid": "27c78277-15e2-46ca-ad41-7be41a75ef9f", "comment": "Malware payload (Mirai)", "value": "b0501baac66352cd2c36326a67dddf999b75bc03b1e9c7facb384eb5e440c64d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050119, "uuid": "9293ae96-f725-47a1-b74b-750c25f76dac", "comment": "Malware payload (Mirai)", "value": "e7ca63823e99e62f0a9189a56a8207a5cfec445b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050119, "uuid": "66791575-5c45-4182-b8c3-6b9440af6986", "comment": "Malware payload (Mirai)", "value": "ce4ee722883e22b6d7f9f7d9f8421a11ba0b055955f816c189bf829a0854d62c4ea3411d7c6528bb5fe4d346ff0fde49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050119, "uuid": "05600f12-3c3a-4b3a-8000-202ff8554069", "value": "T1DF933951FD819A12CAC112B7FBAE428D372713A9E2EE32039D255F2173CB91B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050119, "uuid": "69381ed9-5aac-43bb-b246-cefb30d183a7", "value": "1536:dwIJAJrFrBLKneYCmNK71lRAM279ACI8abdOsvQ+E:dwIJKrFrArNKRlRAMJnpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050119, "uuid": "1bdd21e2-0bf7-4eea-a4b6-635ebf5348ba", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050119, "uuid": "82a1352c-0bd1-4da2-a300-c96844b300e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050119, "uuid": "91f6b2a2-b1c1-42a0-9deb-084781499fcd", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b4420f-d27c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765009114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765009114, "uuid": "cf46abd2-75aa-4214-95ce-9120e433a0da", "comment": "Malware payload", "value": "369df0cd85d7b3bc6b40d3e2ad9c402b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765009114, "uuid": "93b95a9a-f1e9-4ad9-b201-6ef076adf019", "comment": "Malware payload", "value": "b15f2fa6680a298c1951477d12b0d429d1d76321be77b82dad8f0b99f05b5cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765009114, "uuid": "42605fe5-d0d0-42dc-9a1b-cf9b44a8ddf6", "comment": "Malware payload", "value": "a5c5861dd0042a4f6108c8fbf48353ac47c355cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765009114, "uuid": "8de4a113-c6ff-4ce4-a978-aa9730fdebc5", "comment": "Malware payload", "value": "5602ee9c98fcd1a67c22395d48db84f7d4f339d7cbc7450b96e82bebcbf1812d814f5d6b8fe23ee70df40698d9072c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765009114, "uuid": "bf62c59b-52dc-40a2-9c30-80c3792c3b6c", "value": "T1C53602427AE13175CBB3D03F57D38127E1E2700693658ECF26A50A015A12DDA2F6BF7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765009114, "uuid": "959b6970-7b8f-464b-a431-d33bd3e8b2d6", "value": "9c85d2174086fa8f13a57910405f53ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765009114, "uuid": "433818f9-0f86-452c-9179-de4362d8a0c9", "value": "98304:Zc6DysEKPBvlokYmCD2jT8mQAc+/kxQjNTIjaLx:ZcIEeCkYmCD2jT8m5Psjgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765009114, "uuid": "6927005b-4ca3-4ea8-99e6-52f7079cd810", "value": 5027328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765009114, "uuid": "6404d9c4-a392-4dc0-b1b1-0a9063bde879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765009114, "uuid": "f0c1131e-c2ec-47e5-bc9e-10024616ca38", "value": "ghostabi-watbojw0oh66lgj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a499699-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042242, "uuid": "85370a53-f7ac-43a9-98d5-e3a12d1535db", "comment": "Malware payload", "value": "decf4a4595e3d0cc3edd6e976755e74f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042242, "uuid": "7edae976-4137-42f3-8fb7-3ac4a39f4c6f", "comment": "Malware payload", "value": "b235e7660cfa48ef9f2676161eebcdc14992a63dbff5fd40e5609a49898f642f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042242, "uuid": "458c0e1c-0f04-41d6-88ee-d548e5f0c1f7", "comment": "Malware payload", "value": "b269bc65e1a6c8d693517d3931f33d5da59820fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042242, "uuid": "fea64a18-81c0-413e-8285-7b530bc45728", "comment": "Malware payload", "value": "42130eb8381226f3c9c76c503da58ef4272efc2f234dbfdc8cb0d098ea221bed0ecd38908ec40bd10742dfa7de36323e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042242, "uuid": "082b2d78-84e6-468b-9bf4-83e5846c48a8", "value": "T122A47C46B7A45268D09BC0748357A672AF71B8992720BBBF03D092342F57FE21F6C719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042242, "uuid": "0cbcf1a9-61b4-45b8-a724-a5e3a9d5daeb", "value": "fcdd976a24be670f3c5d7696a5f606d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042242, "uuid": "c966cccf-684f-41d8-b06a-6dc58ea243e4", "value": "6144:j8I27kkJnSk+5PXh2D/R+W2cvXSHxmEVIZpZeBtB7gdgpSzGvrsgG:gms2cv+xhVH3BMKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042242, "uuid": "ad7c817e-a140-4bda-9a31-aaa9d406ac64", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042242, "uuid": "2d300277-376c-46be-a833-86269952b32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042242, "uuid": "9daaa23d-c360-49d6-8ab4-d941b12b0bf2", "value": "nethost_v2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c69f24-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038656, "uuid": "6fd01bf0-a9c2-463d-ab0d-9c669c0f8b1f", "comment": "Malware payload (Mirai)", "value": "507fed1decf6716f4b78124632403c15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038656, "uuid": "f1d67516-c2ba-4e4d-8cd4-ee4ce993081f", "comment": "Malware payload (Mirai)", "value": "b23df9af8e4a77a372c1b725947289aea55192dad5bcb0e90374e6a0201afa37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038656, "uuid": "13a2d9f6-5a92-4283-bd08-a75c2066b4c4", "comment": "Malware payload (Mirai)", "value": "652da95ad59bdc917ac1f392ca86e73421021943", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038656, "uuid": "14b84d10-6a94-4559-8216-04c9e1b1f7ec", "comment": "Malware payload (Mirai)", "value": "4eddc26857a0a235b630785fe12ae562899dc94f4d407f1d7937b7a7aee07e342de05ee1c1fe195c54510877df32c6f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038656, "uuid": "eb9fee32-0671-47ee-99b2-f26e322a3429", "value": "T18883E988EA07D1F4DE4B4C315057F63FC7316E10C934DEAADF85AF46D927922A01AB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038656, "uuid": "30dee8d9-7448-4f1e-8a7a-d2809958fbc3", "value": "1536:l38jYHlT+aA6gEaenK3FCfQXG4sKdlSSjUSWw8fUA31kczYMBSqr:l5+aDgEazEQXG4sU0S4Pn/acxwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038656, "uuid": "b0d2e9d3-f6c5-4403-87d9-d84ffbab01b8", "value": 86660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038656, "uuid": "64869f85-6a15-4645-9e12-38be5a171dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038656, "uuid": "a8e29262-f010-4c2d-a729-53c270186bc5", "value": "h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aafb88a-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050054, "uuid": "1168b08f-9936-402e-90a8-e729914ad5e0", "comment": "Malware payload (Mirai)", "value": "68a3c67bb07d39e24c4026ad03d320a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050054, "uuid": "fec446fa-5cef-41b2-babc-b8d60f04a0dc", "comment": "Malware payload (Mirai)", "value": "b2f39e61a8489485c6a66157f7e45c021ec0f12f3d0e4e4c693e79873f339edb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050054, "uuid": "753e5c2c-5aab-4bca-a669-5dc72d8ad233", "comment": "Malware payload (Mirai)", "value": "ea701cb797ba9c6c0c428f83a26e87d99fd2e7fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050054, "uuid": "a9a1474c-2de3-4b64-b446-563ca274f40e", "comment": "Malware payload (Mirai)", "value": "5571fb59bb871c6e0237c1b0bd05f0093f77a78dc91e6f23ce23e75a74579edc389b78e04b7876d8ef0a5db6884ccbe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050054, "uuid": "d6ee69b0-51d7-4444-a98b-ad0fa8c0e5cc", "value": "T15C13F1DEF79A795ACE9F4CF501C242A4A9D9F2913B829E4F831A0C4CFE6294974CC135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050054, "uuid": "4c4da9fc-b08f-4f14-ab71-71999aaa20b8", "value": "768:ORZe/ZCbkHnlrbF/8sgheX0yyrv/TjEDSF6hg2Mf9UNrJP594WrWQ:i2UXu0yyr/EDS4h1McrJP594K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050054, "uuid": "7afbe8a5-c21a-4460-a5f5-a84bb9150fc6", "value": 44108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050054, "uuid": "27804790-c45b-4be2-a960-dacc6622255a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050054, "uuid": "e520f0db-4a31-4b52-bb83-c6afb51f3099", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09a572f-d247-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764986579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986579, "uuid": "62e23cdd-952d-4662-b33d-ade94b0e5fe6", "comment": "Malware payload", "value": "83f9a3b82b523a6ac7ff563cda668784", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986579, "uuid": "9005e4b5-935e-4dc6-9dfc-020d387fba1c", "comment": "Malware payload", "value": "b33d468641a0d3c897e571426804c65daae3ed939eab4126c3aa3fa8531de5e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986579, "uuid": "0e84b6d9-89fc-4726-9c08-86e4469e3008", "comment": "Malware payload", "value": "eb596630399a04f7c7cddd044112fb9d31faecae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764986579, "uuid": "f00dca3d-74d2-4241-9d13-e6cd0918dd8c", "comment": "Malware payload", "value": "d81050780dc79401669feaff2e0fce607fe2fc21d0f0a2723d2936a243edd4f4d9c90ac086671eefd814af2f9b23c403", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986579, "uuid": "ab9b98b8-5223-4a53-9939-2c6daf4a5791", "value": "T17AF0C986467327B82028E81A17D2A067A504A0331C113706B0FFB1183F98B68B5F333A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986579, "uuid": "6a8247cd-ff68-4a00-a7d5-68807eeffdef", "value": "12:r+UcyDOgKrtLl1eoyHk8FEoCVk8FT1RI8luvn12wIkF:r+Rp1+HKo+R1RTcn12NkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764986579, "uuid": "ddc91669-936e-45d2-b6c0-4df4ca0ddd49", "value": 550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764986579, "uuid": "427f980f-1570-447f-b618-5c1114f07e64", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764986579, "uuid": "c7dda180-86f8-4a15-a71b-ba7ae3027755", "value": "test.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bc7f54-d296-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765020323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020323, "uuid": "b1b0ff16-bf7d-4237-b89d-3d76e9e56b2a", "comment": "Malware payload", "value": "da79dd7a5f3c512c7ae04ec3d4a43bb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020323, "uuid": "8a206496-9bec-4ad2-8039-ce09af577960", "comment": "Malware payload", "value": "b5fb06677ed9cf05ec62ef090c135504e0536ec11206377f4395f769c26111c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020323, "uuid": "ecbcd0f2-2ac8-477f-b986-f20ed15b9c8c", "comment": "Malware payload", "value": "2ab22267f79e22ecf0bc746d272282f595b733e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020323, "uuid": "de9e69db-6559-4dba-b7be-c66d051e43a0", "comment": "Malware payload", "value": "187632394e406436ad51ef0604f51a746eed588b405d412af3cfb26e4f234930c287835f4adf0f62e1febbcd337c2a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020323, "uuid": "44ba4f35-ac83-435a-a7d8-3ae438db1cc9", "value": "T16704889D766072EFC857D472DEA82CA8FA5034BB831F4213902715ADEA4D89BDF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020323, "uuid": "0ea65f17-50ee-4a80-83b7-d120357cf1e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020323, "uuid": "75c5d796-e0d1-465a-910a-a72244accbef", "value": "3072:8sr19lVai3umnCvg4bFCMgwASYebIP2fbzL20ZMTWrbphuFdvfpDW13j+EnR+x:THlRrCvg4bFLUSYebIP2fbzL20ZMTWrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765020323, "uuid": "56d35aff-ec5b-4246-92e6-c074b877a550", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765020323, "uuid": "710e7daf-7b68-4f6c-bf20-35105b36fc2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020323, "uuid": "038fccb9-4d7c-4470-84a7-897a61fb2c66", "value": "SecuriteInfo.com.Win32.MalwareX-gen.55539498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab8673a-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038673, "uuid": "6b229793-530c-48e0-bacd-a05d903d1069", "comment": "Malware payload (Mirai)", "value": "4ebe72cb680b8403b00ad31fc0c51e09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038673, "uuid": "468e31a1-4b56-452c-a18a-ef1ad80cc28d", "comment": "Malware payload (Mirai)", "value": "b64cd14a96213c9ed6372129c68fb1800892331dbdd49b7c1514154b9c21dc58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038673, "uuid": "9ac851c6-5ec7-4fc7-a3c7-a2cef1e95419", "comment": "Malware payload (Mirai)", "value": "f1edf4bcc8876636cc479af866bf5924836a5f64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038673, "uuid": "27c2bdb3-a154-4b92-805b-b3876d4a8cae", "comment": "Malware payload (Mirai)", "value": "7c66f5d3fc2e8d3c8662e1639bba66b0c2f9c33dc76c11c7669f94f09b95a43b240e09794d2d3cccd3f3e1e277d09ab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038673, "uuid": "f82dcf66-9302-4fec-aaa5-f5fbb49773aa", "value": "T12521DF48FB9B6E9FEDA35039680B0A1540B0B626F8171523E364DE3F5A37299125A4CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038673, "uuid": "fc46619b-f862-43f3-8b8a-67348af18e01", "value": "24:3O/zdz8Pv62Pewc7CreWSJkq9HHOlDSD+z+sSyYT97tnKi+v9PlO4L6fNjvrO:KI621sClSR9nOlDSK+NLT9w9PlO82NXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038673, "uuid": "8675b735-8796-4dd7-9f89-f47b527ad574", "value": 1408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038673, "uuid": "6f623c95-4ab9-4c40-a59b-269282edb2a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038673, "uuid": "f0103356-9ef0-44fc-a41e-bbebfeb45884", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2345d3a1-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043465, "uuid": "bbd27461-e368-43f3-a623-8f9b0d144f5b", "comment": "Malware payload (Mirai)", "value": "9337a277c3e6946411e3875df17ea27c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043465, "uuid": "42aecfe1-8f76-4426-aba9-05a28d33d08f", "comment": "Malware payload (Mirai)", "value": "b67a1c34960d4a7844c7a0ddfed31815f2b687029fcb12eb69734a7fc9350543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043465, "uuid": "52128818-6db8-4c89-ac16-bc4b9ef72f9d", "comment": "Malware payload (Mirai)", "value": "8bfb3e5bb21e48e1009cf314f7710977e7fba258", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043465, "uuid": "a15b442c-04a3-4631-a84a-6ef6e5485d9f", "comment": "Malware payload (Mirai)", "value": "936838b77761b4133518dec06d878378d97c467716cbabf402e376c1a4173c52362ae0c92e40c36ee279d82bc76c4f90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043465, "uuid": "253871cb-a3cf-4379-af77-3466fa3e54a1", "value": "T1D343F174C9C2DEA4F6287476CF6AC2403D8B0A7894FD3C8F2F9565B878A3B165785107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043465, "uuid": "37659dbb-88dd-493d-9e09-4d4da3baee14", "value": "1536:LPS4tGi3ASymf2E8r64ONP72GFZ4LCYYH9r2:LPltGi3z2E847ncLCYo9r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043465, "uuid": "aec08d8e-bd80-4e5a-aecf-cb33fd7905a3", "value": 59064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043465, "uuid": "0f14e54d-19ab-43b5-80f3-7be5a71c20aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043465, "uuid": "f6083f93-4c9c-4028-ab08-893eb88ff89f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7f9d0e-d2dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050302, "uuid": "c0275d92-e049-45fd-95af-56f34ba451d7", "comment": "Malware payload (Mirai)", "value": "84e1793fd62ec1ba6281e50c21da1a3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050302, "uuid": "12efeddc-cdf4-4860-981c-33331fb331ed", "comment": "Malware payload (Mirai)", "value": "b6f248d426e6c610037c7845b4533f0152a37702a9f9c8062cdf51ec3038c17d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050302, "uuid": "599d2ce6-f6a9-4388-9063-7310b9c77ca0", "comment": "Malware payload (Mirai)", "value": "7f70c6f6a9e2a17c44bf5cbcc8778b0495eeba2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050302, "uuid": "5fb1f4be-437a-4024-82a8-b95204eea1d4", "comment": "Malware payload (Mirai)", "value": "3fd6210a8b6b42cce4debb5130f73c29e546d4a0b9d2db0d6f95dec53706704b8a965765cb91ad0f29778976e51ec6f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050302, "uuid": "bc28fc51-d9f3-4745-97c4-92fbf70ca40f", "value": "T10213F11C4B3548E9CCDDD0FD1BBD23903E6601625042C8587A39FABB8DCAA6C78027CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050302, "uuid": "6614bdb6-7128-4bd1-b6fc-3d218c14e385", "value": "768:oA2vqoP2Dt4BcdvtNzYJMUZ6u5UeJ41WZg0JgGlzDpbuR1J7P:oVv122BW5YJMk64UGMWtVJuBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050302, "uuid": "ee550cf4-519d-4386-b915-454a7ffb8ca0", "value": 43236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050302, "uuid": "fb8969c3-a49a-4a4d-ae41-21ba87d38897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050302, "uuid": "fec2f508-292e-42a3-827a-d93005027c2f", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7758507e-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050049, "uuid": "acb463e7-de9f-4632-91e0-8169b1f929e0", "comment": "Malware payload (Mirai)", "value": "1efbff1ba0a49d94bf139347de87c16c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050049, "uuid": "3961bb7c-f212-40f9-8200-ab4bfa9ef4cc", "comment": "Malware payload (Mirai)", "value": "b6f2fbe8b45689f77bf4014760702e396eea794472697cc822ba8e7b544e27c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050049, "uuid": "d554cd04-15ef-4dfa-9212-f6de58a3bb94", "comment": "Malware payload (Mirai)", "value": "f248ff657001dae5f3c4ffed795df8da3380db35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050049, "uuid": "3dfff703-3732-4d49-9516-4712f9e3a573", "comment": "Malware payload (Mirai)", "value": "7001ef209e4b990d71cd22a6f6cd9cbc5ac20b739e76dfeba358373f4a6e293027bfa82a78b2da15d0ca26a3fa5cb885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050049, "uuid": "c6a05597-b535-4159-9f86-44b8336885c2", "value": "T18E63F1D5755FF738D073D97328884E82A9198A3BCA5726DB7114F1C4FB616A1388FC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050049, "uuid": "d31ac850-889d-4b7f-b78f-6cfb607e1498", "value": "1536:7DyhE4aZO5wKuFquQgViJgo32ZJq7L0BKxEZk0prlGi+:3RZWwKI5Qwc7L0sck0prn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050049, "uuid": "b5d577f0-3e38-4344-846f-c60302554a5b", "value": 67000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050049, "uuid": "31a77f7e-e060-47e9-afaf-bd6e69c2d4a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050049, "uuid": "e3b53f40-d5b7-41d0-9b13-f73f33410355", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abc5dd1-d2f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061677, "uuid": "88df4375-74da-42f5-962f-f4321d1cb023", "comment": "Malware payload (Mirai)", "value": "bf21aae313beb9e3f2ea26b3d9bc698f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061677, "uuid": "3f9ff7a9-197e-4ffb-b2a4-c8f068ddb5d0", "comment": "Malware payload (Mirai)", "value": "b72b8a3384292dda4c3fe8766ecbd795e9e93b44a55f3dfdc50cf17e1452d235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061677, "uuid": "f2f6a5ab-ebe8-4332-b860-3ce524dbb89e", "comment": "Malware payload (Mirai)", "value": "07582c4b55981778e7d666c9b1161b71119b37f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061677, "uuid": "fdbf33fc-819c-4501-88c8-94b73397184f", "comment": "Malware payload (Mirai)", "value": "e9b240bf785890bf9d675c2b2763be06023e25ed4d8d96e46721537b48997afc66018e38d75c0c8e5c0273e6f938c421", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061677, "uuid": "7324563a-f928-415c-b570-ffc7b4c2006a", "value": "T18D534A02731C0E9BC1635DB4363F27E193BBF99121F4BA84681E9B4A9275D325186FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061677, "uuid": "d9f956fe-21a0-4bfa-9a7b-da7d6320bde0", "value": "768:mySPUwQq8FiRB0Xrh5saxoMULXlj+JqYMXsJ9Oww7Zzyf+NFFiQtqbJhJzL1JIA:AYFiSgaxgQqKOvlzyfKKQILJjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061677, "uuid": "7ba4934f-e7d2-4a63-a0d1-f0b33437360e", "value": 62884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061677, "uuid": "64e1e7c5-db01-40fd-b78e-aa5baf99b1b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061677, "uuid": "ce72cd87-387b-4df2-8698-535cf500de32", "value": "fent.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ee916f-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050046, "uuid": "f6f35b49-370c-4680-8c8e-f91b79c45071", "comment": "Malware payload (Mirai)", "value": "c95d2b323f1eedf2c8491a0baed5ee2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050046, "uuid": "d48daf8c-2e71-43e2-a661-d3cba0e00e67", "comment": "Malware payload (Mirai)", "value": "b74fb7bead733da7f79387a8ca81e45d5b683da8e9d5271e68cca1d2534b3c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050046, "uuid": "d539ffbc-753d-4351-8a8f-ade247c0b834", "comment": "Malware payload (Mirai)", "value": "c96a9d40d1b6d1fcbb2441c7cf9f459f3e4bef38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050046, "uuid": "33b5d427-717d-4296-90b6-e15cbfe93391", "comment": "Malware payload (Mirai)", "value": "81a09a46edfca22eba92efd833417510b840f0574c1807e295cf942eb41aa1b445605b5464d2bf13450d9b8b3af9c5b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050046, "uuid": "4ba7d807-984a-4e99-a751-2181375bb3fe", "value": "T19C6312C6722FBC528B45BD7763BB57914799FFBD4A948C23218C1C283EE11A938F4246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050046, "uuid": "5ed060e7-49ca-4754-8eeb-23ed78d8697c", "value": "1536:D5JLdA1B/r8At1wfCuLaWLqdFi+4bJXH+3F:DLLdA1VrlDwfCuLb4oJu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050046, "uuid": "5a6df35b-4732-4e42-bca0-c6cf9b198bb1", "value": 66960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050046, "uuid": "76c528f6-3bbb-48a4-968c-30aa25ccdd23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050046, "uuid": "91fa1db0-263b-41a9-a7e1-10e7fcf6e976", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274c2752-d24e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764989355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764989355, "uuid": "1d1e9dea-6661-4b90-a759-ef7cbc67ecc8", "comment": "Malware payload", "value": "c6536b283511f24fe018f9ac9419cd56", "object_relation": "md5", "Tag": [ { "name": "ramcos", "colour": "#258E13", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764989355, "uuid": "45cd2f64-8518-4a53-bf8d-4e1454183492", "comment": "Malware payload", "value": "b79b2fe8d0e0e1f280939dd93cf6d0a77bd41f00c5ad64f70fcf4d683128c08d", "object_relation": "sha256", "Tag": [ { "name": "ramcos", "colour": "#258E13", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764989355, "uuid": "db8c2aa8-09fd-4ed4-98ee-4ea8da1bc324", "comment": "Malware payload", "value": "a09da01f3d27b4c842ea57e3bce8138c0bcad73f", "object_relation": "sha1", "Tag": [ { "name": "ramcos", "colour": "#258E13", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764989355, "uuid": "b6398cb8-1d9a-4ecb-b880-1e28418f916d", "comment": "Malware payload", "value": "c6adeae0fad1c49bc1d29de726a0d2d43f049b09481db04b3261a640f4d8871cc3b232382fbe525b325aa280938c4673", "object_relation": "sha3-384", "Tag": [ { "name": "ramcos", "colour": "#258E13", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764989355, "uuid": "36db71bf-cd24-4362-9e89-83beede0e33f", "value": "T172D533D76AC312EDB709B7BD91CA7A0A7853EAE5D7731A718340B94D494BC4B40D2332", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764989355, "uuid": "546ac436-c5a2-41de-a65e-998115532fc2", "value": "49152:O3JtjKqPiu0BotgCjLYrAMHNuqphxDI5L/vC7AvCmjFb0H2DvfPl:O3Jtj5QytVYJBLZooA1h0H2DvfPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764989355, "uuid": "163b6f58-348a-439c-a587-374ea49f0c18", "value": 2853489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764989355, "uuid": "071c9419-ff62-4e23-ab59-de4c4feae23d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764989355, "uuid": "7a548dc0-95ff-4378-8bd3-d7d82fc1dead", "value": "formulario_agendamiento_citas.zip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0db70f7-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033905, "uuid": "592e1cf6-316a-4223-90ff-9d99a73ad600", "comment": "Malware payload (Mirai)", "value": "ececaff977d7119ffd2d520387dd0fb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033905, "uuid": "197ef731-ed88-4b08-a776-a943b8dc3490", "comment": "Malware payload (Mirai)", "value": "b7a1a143c290abbe9ace86c10e26b620977bc3ba3002bb30ab057218fc1d6374", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033905, "uuid": "aae11d7b-70f9-43ed-9f6a-fc7637367d71", "comment": "Malware payload (Mirai)", "value": "4b197eefb21964221b6bf1ee1e4887015eb8889f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033905, "uuid": "d9dc485c-c8a4-44ae-9cf5-8e1cdd3ffdab", "comment": "Malware payload (Mirai)", "value": "86724f41dc8913d8f314066ef8de859d5f70425eb02021ff0ac7a2e9c73e82c385bc5e3e737415bcbf11ab5ee384f0a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033905, "uuid": "f878c45a-6d94-48fd-9a14-11edc2c6ede9", "value": "T12A331882B8819E06CFC0137ABB6D128D372527ECE1EA73036D116F687ADA91F0D7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033905, "uuid": "fce4c608-7e1d-4c66-8518-4aa8806bb226", "value": "768:7jzGFFJot5QVQXogjpwFh0GXoGPGV3Efb2LITookfCiMjYntKfPNOTaatUidiD/:KFM5Q2XoKwfImG+faH4j2SvWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033905, "uuid": "aaf0df54-ad17-45cc-8611-6368a763cc7e", "value": 50216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033905, "uuid": "c9f1f2b8-38c0-4dee-a0a5-d60551954a0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033905, "uuid": "1fb0c81e-fa98-4a15-8627-aa98c9444763", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0fefa0-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764981634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981634, "uuid": "296c07a7-e84d-488a-b5a2-92df6af62a74", "comment": "Malware payload", "value": "40c7d964c4c93a4a378386e7e4b73b28", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981634, "uuid": "00904234-ae24-448e-87e0-f9d7ca66aef9", "comment": "Malware payload", "value": "b7c5b1d8b12a56fd753ea17ae19984f2495fb82fe7b2753aa0654a74d006b7b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981634, "uuid": "19ad2a62-b402-4f95-8fea-2e78da8294de", "comment": "Malware payload", "value": "d33b1049248fc4c09af62606e347ba64fa55efa1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981634, "uuid": "8c847230-06e4-44d5-b65d-b924fd9ae3ec", "comment": "Malware payload", "value": "ad39929c01dbdd6a283daa921e343bdc4c2fcdd8511450f9788364f894893270d85a6328783df0e956e45426657d8298", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981634, "uuid": "4dbc65ba-690d-48cd-bd1d-e51b7ec67204", "value": "T15741A3C8206345F1FA526A36B2B5441874E1A3D238869EE5B9FDF4BA004ED407B41EB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981634, "uuid": "b944a2ff-9c65-432d-abb6-3516b21c9ccc", "value": "24:v5niQt5sA4t5q0Vzt5mP9t5OFt5k0pt5sht5KPt5KWKTFEt5SbvPQ:vBAwWqXKXMAARTm8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981634, "uuid": "b44137e9-55df-4304-9c61-fd5dfb2f0b78", "value": 1908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981634, "uuid": "be0e7e02-8ee6-4f9a-a53f-2de85d3218c0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981634, "uuid": "6bd7bd43-506b-434d-a873-3a60b38805dc", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ec36c6-d2f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765060483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060483, "uuid": "d454507b-0564-46a4-8708-4e5552e07f4b", "comment": "Malware payload", "value": "17a421fa0db07b0dbf75f1952e5ccb2f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060483, "uuid": "6c7ca2f7-8c7a-40d2-85ff-f19e10a696ad", "comment": "Malware payload", "value": "b7d11cda9b9c4f108981c03ca3f6fdc4b67b77a374812f1e2ed9967e19dbcd91", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060483, "uuid": "e8dcf802-8f5c-44c0-b133-ea92d40696af", "comment": "Malware payload", "value": "6d742ea5c5226093c1b0dd313ddbbd777d43d45c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765060483, "uuid": "06297f99-f6cd-4a29-846a-bda91a1b090e", "comment": "Malware payload", "value": "c37b4c3908ef2b01363e79ebb2cc8bae1e7063ce8fb7aff1d92e5fc126785576cf1fda58a4f1eb6991c0eaaf7ce99020", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060483, "uuid": "b928843f-01ac-4537-b869-175eb08a8466", "value": "T125015BFF004D96354E40894DB5A7892974338BEB90E5C60DA98DA527B389E2CB433E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060483, "uuid": "118b70e6-14ee-4c35-ae6c-67ce632dafeb", "value": "24:Z+ZOBkRD3v6oYkRD3v688kRD3v6l5Dl5nkRD3v6aO9kRD3v6SmkRD3vXw:UZAkR+kRYkR6n9kRWkRmkRTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765060483, "uuid": "58174c5a-9619-4851-98de-942c1e3b4d67", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765060483, "uuid": "d3ca10c9-e3dd-42bd-bddf-e9e3342a657d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765060483, "uuid": "51ebdc5b-f8b5-4863-8d21-85a668958625", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fef1ef-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003129, "uuid": "37d7ea54-55d6-4dbc-aa18-f4fdb140ee67", "comment": "Malware payload (Mirai)", "value": "f0477344526b684ed7f506244acd2413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003129, "uuid": "bde449e7-aa26-443e-bd8a-763ee4866db7", "comment": "Malware payload (Mirai)", "value": "b87698667e60d4b24629be671d23ec2e189adad39410a012c66d2443d65058ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003129, "uuid": "d3076908-dede-4e4d-a75e-4f6abc740366", "comment": "Malware payload (Mirai)", "value": "9e4d2debe57a356ac3ece63ec109d18906d0e6cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003129, "uuid": "6a512bb7-75d5-4cdd-959e-53a07563b16a", "comment": "Malware payload (Mirai)", "value": "940f7446ea1349123d3c3d67a696b52b1bbce778fad23507653dccb2a401c907941a604b86f52b540020015e099583ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003129, "uuid": "92344b21-d49d-478d-9f43-16fb7c52c058", "value": "T190A34A0172280B97E6A34DB02F3F2BE287BA999520F47549650BEF5A87B1D325407ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003129, "uuid": "d2f3b43a-aeb5-44c6-a525-e27b6a911b44", "value": "1536:WluEKsGVU4u+kJCXrGPVZp0qH4RhA0wr3G4yb17+vxuMHyBPQrl:Qu5sG6V+kJCbGMw6Z7+U1Bgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003129, "uuid": "0436d3de-1abe-4133-a962-989a01a90a07", "value": 99024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003129, "uuid": "e6ab9aa6-4cf0-40ea-9a39-57f2d2c299a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003129, "uuid": "a383031a-fc71-4518-9538-bcd8df9113a9", "value": "ppc440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5110573e-d2f7-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1765062010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062010, "uuid": "2050361d-88f3-4aae-a3d8-83ca69d1468a", "comment": "Malware payload (CobaltStrike)", "value": "158a92efcbd66aaa89a2a8c891b44522", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062010, "uuid": "300915b3-639a-43f7-b1dc-aa723ad5040c", "comment": "Malware payload (CobaltStrike)", "value": "b8da01345eaa92f4823e5c6097ec592e4e4666380ec4108a350bff0e6cd7d344", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062010, "uuid": "3b4d533c-7130-4ba0-8561-f4d4abb91cfb", "comment": "Malware payload (CobaltStrike)", "value": "ceed86a85cd23e07920038a61b2b1818b2ec8b5e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062010, "uuid": "54af1367-6ff6-447c-8038-e2d48bdc89d0", "comment": "Malware payload (CobaltStrike)", "value": "1d031a071391f513f42f59c6783043d831fdb198cd978aa434a9cf92487aa8d2121c3e1a5bfb00c8c76d1e02bd3fd4df", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062010, "uuid": "0c75c02e-e118-4f8d-a61a-129b7190b397", "value": "T13664ADB1C71A259CF269013FA9BB3D399540E185C4E831617CFB44CADA8D60F49DAFB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062010, "uuid": "88242bb5-d04b-44b5-8187-28bce58849b4", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062010, "uuid": "726c5a54-8812-4b7f-8a7c-8059b78b078b", "value": "3072:M0iRADqbH8NEbYuMi/z3zwmfy0cZ5ZyIkM5jIR8P3X0QVmaob1NQYSpWmCH3JgFA:MjKqzlYuMqrzbaxWaD3zVyApoaDNybR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765062010, "uuid": "a2fbe82e-1119-4411-bf5b-2fcad740102e", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765062010, "uuid": "f9dbb1ec-56ea-4d31-9474-3d72a0b4946b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062010, "uuid": "e80210d8-3427-4648-9cea-6ecbc161b939", "value": "stagelessx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9756937-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048925, "uuid": "bc538ad5-d0c2-41de-9422-1abce8a27e40", "comment": "Malware payload (Mirai)", "value": "28f2aee172edf5356bf005e874479b5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048925, "uuid": "12f2a91c-88ce-41ad-a04c-c7398acb8cf5", "comment": "Malware payload (Mirai)", "value": "b9515522170282f8cb7959367d6bb768a34891fffa773e3989b296817bb06dc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048925, "uuid": "eae85aa6-0477-477d-95e6-a92f08d305b6", "comment": "Malware payload (Mirai)", "value": "9c2b07f293fda4c0a9cfc10ea09b4a01d121fea5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048925, "uuid": "d831d0f9-d16f-430f-b3cd-8c3a1d70f18d", "comment": "Malware payload (Mirai)", "value": "debde7852efdceee51d426ba6424df14df44ea3702e5360ecabb5dbc242d4eda07698605fd47cfdaafb7b04587ab45f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048925, "uuid": "b548d029-5edc-46a7-a931-7c604338fc22", "value": "T1EAB339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048925, "uuid": "ce92f643-907a-4582-b3e6-4de754a4d009", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wczSr9bMFflw:Pbj4doYGFB0/45gdA9ulw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048925, "uuid": "f37876a1-12d5-46f7-b56d-fd932a5f5657", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048925, "uuid": "b0a0ac50-842c-444d-b389-6028a4a97277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048925, "uuid": "6e919df2-9b6c-44b0-9a59-cc0665d1cfed", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b1917c-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042159, "uuid": "4bc6d2b9-fdee-4f80-b9ac-ea992f161416", "comment": "Malware payload", "value": "70e5c9b8827d3808a6a5088ef582fe96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042159, "uuid": "9eb26fe1-8d2e-4bfc-80e3-ce043f00b6c9", "comment": "Malware payload", "value": "ba0ffac6927dbc9ea581538291d9eed369277957573ded03d212a99053dbdd1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042159, "uuid": "b4a66a04-380f-4a45-8dc3-76e4b3cb6f6f", "comment": "Malware payload", "value": "31b8768646f57c47608895855ca0e99395bb102c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042159, "uuid": "48f3e9de-27ce-4be0-9263-38a76064e976", "comment": "Malware payload", "value": "df75e6f82f5a49a976f504622ad4f08d8cc994eef204413e91e4ff4e41fe103c6b0de5dba6718ebc28e697dfcec08ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042159, "uuid": "538d4d39-0cd6-428a-b041-4b80ed2c9777", "value": "T18E72290833E84254E1FF4B7D99B2021849B6F96A6839EF4D1CCD616E1DE37849A10FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042159, "uuid": "2fbf4c1e-64c6-43c7-a1d6-6456821fac8e", "value": "384:yP4lTO7H/jKnE4fldFkCWR9VZwVq/x3WqVQNhL:yP4lq7unEjC+9rlVYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042159, "uuid": "338841e0-ac02-4bcb-b5af-96d9bc1c0636", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042159, "uuid": "0ad3cddd-2fc1-49ca-b5ee-78fdd1edeec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042159, "uuid": "816b5132-7bdc-4e08-b8e9-ebbd5ff1a566", "value": "agent_mem_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed77e05-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050115, "uuid": "6fa9a843-4acd-4d39-804a-a95a48a8b717", "comment": "Malware payload (Mirai)", "value": "be8a7cf255de531846b7fab409392e4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050115, "uuid": "a2da1c10-7d96-45fe-81ca-891be206ce14", "comment": "Malware payload (Mirai)", "value": "ba4f9fa18f71f15614bf63cce82f5b3af36a5bfcb4bd5917d57867ed1d110cdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050115, "uuid": "b0d142ec-7792-494d-84ea-5394f8288bad", "comment": "Malware payload (Mirai)", "value": "2e0182125e45fa09524843518463bc84c7f0b519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050115, "uuid": "5b874e59-a4e8-4877-aea0-5a89ee7e6490", "comment": "Malware payload (Mirai)", "value": "bf2a295dba2577b95c25cab00370b9a0825788dcbdbd2615ce52ad19ea64b379115ba5a6b28b998507d40894c396d72a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050115, "uuid": "5afbda9f-caef-491e-8e66-2042b719b4f8", "value": "T1AB935C02B70C0E47D1675DB03A3F27D1D3EF9EA120E4F684651FBA8591B6E321686EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050115, "uuid": "6701f978-57d6-4992-8a7d-e097ee013eec", "value": "1536:cpwUxdVXYbTLGrHxqSrGmBzOCUl2GpV+1RTVH5Z9q86aQGQTFL1Lh:cptBITiV8VuHZ96Fvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050115, "uuid": "fc589dac-273e-45ca-b6de-e35a2e37ab8b", "value": 89560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050115, "uuid": "3151d334-35a6-4ace-ad66-19c5801f1c70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050115, "uuid": "3957bb79-09f8-423e-af19-5e4bceaa2be6", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f99928-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033833, "uuid": "f6b9ac1b-5be5-40e1-ba1c-63be46573d9a", "comment": "Malware payload (Mirai)", "value": "0f23a0dfa9375902d9b44286cd65631e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033833, "uuid": "33365291-4aba-40d3-98ff-2a42603f088f", "comment": "Malware payload (Mirai)", "value": "ba6753d14a6658be35bdd515175c82cfa5c1a321a74f054c855beeacf5d9e70e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033833, "uuid": "1f336873-664a-436b-95a9-096dce59bacc", "comment": "Malware payload (Mirai)", "value": "dc50b98a67bd0a3306f241c6324a95c7b7142b6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033833, "uuid": "a55d50ff-c03a-43db-b116-4c1eb4c0eaff", "comment": "Malware payload (Mirai)", "value": "1491f85b1298e0c8750147cc74e32febada6270bfcf54745f41cdfec618441b5046083ced7abe9a7102404d7d8ff29f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033833, "uuid": "3c3f9e90-7936-4934-a135-8021e3c1380b", "value": "T150A2E0915686D6B2C73E0439FAFF458B319786FD90FAB63602104B34BDC542512F35CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033833, "uuid": "9532cb45-c4cd-453c-bf1d-d28eaf6005eb", "value": "384:cAD5qbWJj+woWlb7mNCSr3Rj7iMFra6PMthdObBBhymdGUop5h1:vD5KOTog7mNxr3Rj7iM9Cv0bHs3Uoz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033833, "uuid": "6ad9d229-a8d7-4851-bda1-efa34f5589a1", "value": 22460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033833, "uuid": "93178943-66e6-44e9-b155-7bcdf76156da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033833, "uuid": "96a81ba6-df62-4ee4-8a3b-a73a3316815d", "value": "b3astmode.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7701b0ca-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049618, "uuid": "02e8e843-6bf7-40c1-80e5-dcd62ae50474", "comment": "Malware payload (Gafgyt)", "value": "2631eb75d548ceb727b6e7f91d7595f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049618, "uuid": "8688cd5e-a58e-4428-8561-bb278a340353", "comment": "Malware payload (Gafgyt)", "value": "ba6b9c8f6b19ccaa3bfeaca1c5bf5925beeb69cb31726f46208d423c1bb4466c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049618, "uuid": "12cda3ca-a51e-441a-866d-4ec79784232a", "comment": "Malware payload (Gafgyt)", "value": "ed6e4c4a50e13dfd9f8d7c29e0a23a5f0349e666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049618, "uuid": "dc49edd8-bd86-43d1-9bc9-352f9023d840", "comment": "Malware payload (Gafgyt)", "value": "b68c4c9c0c7c501d32aa2f602893b031b9f4abbe0caddbaa4aecee00d6e5883c3c75a00fab565e8bd076a831c14054df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049618, "uuid": "353ee433-6703-42fb-815e-2c38f6fb06ad", "value": "T147255B43FB1C4523C9530EF11A3F53D5F7217A4341F5A22A270E9B672622E3AAAC7359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049618, "uuid": "a8ab443d-f453-4629-84e0-dee3d5d575fa", "value": "24576:TvlFAn3FsPHcBvIU4gW/sSiHD0V70sJrl0G3uR:TvlFAn3FsPHuvIU4GXHDXsJJ0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049618, "uuid": "02f36b1a-5d68-42ab-bcab-ee54df8746f2", "value": 1001300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049618, "uuid": "5094dc20-7699-4d4c-a3ca-3d4703422695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049618, "uuid": "2eb65906-ddec-4afa-bd1d-4b8bd0e8bb47", "value": "powerpc.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f511cd5-d278-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765007354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765007354, "uuid": "70f0507a-9fa3-47c8-b3fd-74d054554994", "comment": "Malware payload (Mirai)", "value": "c39b10af12bd5f88e13002b6fd7b0195", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765007354, "uuid": "d92f5cb5-5308-4696-a326-74da1946303e", "comment": "Malware payload (Mirai)", "value": "ba7ad4e8ce27e6cbf364a22728cb02d47f77dc767f9ab85a02256928a65bff24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765007354, "uuid": "3789c3d7-2f00-4e5d-87ca-533f5551e511", "comment": "Malware payload (Mirai)", "value": "5c4271fc812ed04fa94f8f8f803db4615b95df60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765007354, "uuid": "0857ce64-541f-435c-bff4-65721aab2df9", "comment": "Malware payload (Mirai)", "value": "13f0228168a601ce63869c045b1ba1f475d1d503ef5e2422ea273daff1f74ebfe332a5cdd372eead65f7c1e4ceb3301f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765007354, "uuid": "e93b36fc-d62e-42ed-9e66-f7fff8bef027", "value": "T14D247D91F643E5F5DC520971502BBF361E72993A613BDE82E7ACC632EC15602C12B6EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765007354, "uuid": "f62d0226-b2ea-45ee-abae-00205952352f", "value": "3072:8Ce4RmWzEZ4hTHUkHkJL7TZKHmlFnAEwnQJ9Php4ktJwp1YH+VHMhGB1wd6A0:5EqTHFEJhAxnyfIeeVHud6A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765007354, "uuid": "17c8a27f-b675-4433-9c50-4088032b9564", "value": 219752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765007354, "uuid": "afd63fe9-ba63-46fe-a578-3ea9669bef92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765007354, "uuid": "d334be63-e870-40e5-83a0-510577938266", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea2bbec-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981637, "uuid": "1f068c38-b8ae-4465-8c30-3085fe65dd49", "comment": "Malware payload (Mirai)", "value": "bb5772be47e4a0d992676ce1816a8b34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981637, "uuid": "8d3d28e7-9506-4f1c-8e44-26987a94e8bb", "comment": "Malware payload (Mirai)", "value": "baa7f1f82f288d38e86612c75da0f3ecd428689843716f35d41cc3b62b6667e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981637, "uuid": "e529342b-5676-46f9-8bc5-fc965752b2b7", "comment": "Malware payload (Mirai)", "value": "a5a9adc6a4225574db480e17d40f211cea050da5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981637, "uuid": "909bb3bf-0c63-4c0e-be3e-60caf62c47ce", "comment": "Malware payload (Mirai)", "value": "1722b7cc80f45aadf22493331b1a02feb93b458b53e63d9764b9d5c4fa25a63d487787d18d7c84567a4cbc6c20a40b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981637, "uuid": "01f59472-6257-4300-81bc-44d119391808", "value": "T1C1A32A857CC29A22C6E163BBFA6E418D332563E8D2DB3217DC255F1533CA91B0EB7641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981637, "uuid": "14d047d1-1818-454f-8c1d-42eea2f3033c", "value": "3072:lhzzaVEcVvBa+dXYQM0MuAhVJew3jmaSPM/v:lhz/7hmaj/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981637, "uuid": "79c2c408-f849-4faa-a34a-9a9f0ae7a4b9", "value": 100336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981637, "uuid": "cd69c864-98d8-4009-b2e7-b3dc36301361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981637, "uuid": "60f51477-e10a-41f9-891f-b871140a6ed6", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00689f65-d249-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764987142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987142, "uuid": "7f3b4bed-cca8-4ce1-adfb-36a7518a1867", "comment": "Malware payload", "value": "8694a08e1453b1fce5473f3b47917452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987142, "uuid": "7a9019ef-4988-4f61-8c0e-004db95f5c85", "comment": "Malware payload", "value": "bab972378f51e64b6bde99a79c87e109b7015ca3145d51fb3f419ae18e57b965", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987142, "uuid": "be6f97bc-c0b9-49bc-84d3-1728d4bdfe78", "comment": "Malware payload", "value": "70896df0e98643df0b369df1810872ab878b06fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987142, "uuid": "654fef2c-9100-4c78-bfec-8a3d6716f4ae", "comment": "Malware payload", "value": "766a7d7651bab905766dbceada135152a91ea76f58af667f68c0391f270eb3ce4dc46b6eee0b5e6b869cccc087022ad9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987142, "uuid": "d07f8af7-4fe6-4c29-befa-154a4a48436c", "value": "T1CDC6E794F9DB02B7C907583044AA712F133C6D5E8769EE93E6803F0AF8777A3493552A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987142, "uuid": "554561d0-2213-492a-a9a9-f0e9e740013e", "value": "98304:r93675gOvcTmnLwYJGHyRxvJh72c2XKv8FWBDWhXwy:475h9JGHORJIKvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764987142, "uuid": "29aa4335-16ba-42b3-987b-aa680da48f99", "value": 11911168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764987142, "uuid": "9b52ae6b-62b7-47fb-ab79-dbd45d953d3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987142, "uuid": "71508a18-5e2d-4f9e-93a3-05334e1aec4e", "value": "test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e14f19b-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050060, "uuid": "3321e619-fd5e-4904-b246-0ffb90b5d86b", "comment": "Malware payload (Mirai)", "value": "78febda199f7694c080ccbe2feb98068", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050060, "uuid": "ab23f615-924d-4121-a649-7b04af913fc9", "comment": "Malware payload (Mirai)", "value": "bae362a8d2a6a4e8991e17b6629db503fa4a3a607861071ff275d01ac85cdc9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050060, "uuid": "94243cb7-384b-4da9-8069-4a291e2191cd", "comment": "Malware payload (Mirai)", "value": "9adfa417262f13ecbaf943e55559a77b73ed7590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050060, "uuid": "75cdd4c0-bb2b-445d-98fc-2499f4b7b170", "comment": "Malware payload (Mirai)", "value": "20c6a078164b4b49deea0767c2e2b37070041a6eb1364763efcef9813f427837e8f06ffc2ef13a2b22b99e022a008f15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050060, "uuid": "d0265ecb-0fdf-4c67-81e0-3039d4ea9b53", "value": "T1E013F1B7B21EBAF4C06795B720AE1170BDB679010564237B8DE572BE34D7E8D2813E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050060, "uuid": "9dd47e19-507f-4b4d-9274-ddc30bd06772", "value": "768:ib4Y1eWGAUfYHzSqekhRt2HUIt5HiG7by4Jo+aaJ1L5d0x0KX:U1eWzUfMzSqthluiG7btB5EPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050060, "uuid": "54f76b1e-5d92-4da0-9066-265d26b83cec", "value": 41844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050060, "uuid": "c01087cb-7bb8-41d3-b3dc-c09504789e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050060, "uuid": "5a6e979d-4450-4a33-93e3-68055eaac5c5", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ebffed-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050073, "uuid": "381b3158-29b3-4daa-a643-a97809da79f2", "comment": "Malware payload (Mirai)", "value": "47da614739c8fdb7eb50bbd8e6db6b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050073, "uuid": "1cb09e1c-2fd4-42d4-89f6-935180eba4df", "comment": "Malware payload (Mirai)", "value": "bb51e25885d5e77d1c772a51053f9f03fbb64cff853caf5cc55623a393ddb4fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050073, "uuid": "c403f36d-9319-4a3a-bf7c-620343f1f15b", "comment": "Malware payload (Mirai)", "value": "943eece61260c4fe985550335781e19a9450748f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050073, "uuid": "bad40433-7cd7-4b4e-9575-40ac865a9572", "comment": "Malware payload (Mirai)", "value": "3e28c13efa984f8e2afc1547abf18173779acdb569b135f6d5d6f846be290cda9fdde0ddd587fcdc041aaf78e6ef0136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050073, "uuid": "de69a0ec-61fe-4497-82f7-5600ee4460c7", "value": "T1ED03E111E695A829C3A5A871FCED8680377753F4F0F6A0BD6AB4BC3578414DC03E89CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050073, "uuid": "2569969c-cd0b-44d6-84a5-c294b7668990", "value": "768:kTcqXA0rgTpg0msCpTw9tcbRY3xxfFQloaUaLInMXHW2sXms3Uozq:kTOZtCNw9osxfF8oaz0MXWzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050073, "uuid": "0ea01911-506b-4e3e-8f29-4c25affe902c", "value": 40948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050073, "uuid": "4a768ac2-a9f1-4b9a-a7ff-43eb97919da3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050073, "uuid": "b9e9a262-6c79-458f-8089-2c7ded3b5a6b", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e99994f-d2f7-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1765062006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062006, "uuid": "9afeb5dc-5919-4559-8984-d220371b4c31", "comment": "Malware payload (CobaltStrike)", "value": "b790397f574a00b4931d4e5bb97c2161", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062006, "uuid": "6dc0b0ca-84e6-4026-9208-37b6a81de5df", "comment": "Malware payload (CobaltStrike)", "value": "bcc7edf9b378c1d5d8cabfe784a1190f1b05b15196e7d578889718b6b9af1de7", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062006, "uuid": "6489351b-0ef7-463e-9d7f-fcd101254177", "comment": "Malware payload (CobaltStrike)", "value": "3eb8ea92404cb2b4bef7e0f35187b9d8cd6c96be", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765062006, "uuid": "9273cac2-c4ba-4bfb-85af-562deb4b4806", "comment": "Malware payload (CobaltStrike)", "value": "abd69fb80299212ee44eb251f732c722f9c947cda520a1cf1a659ac56a54731906d9999d5be6f030b94b032d33f014f5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062006, "uuid": "1764113f-aac3-4d63-a3c0-95fccd48ac10", "value": "T18C62D8B1E90378B2E9155CF049FBBBB66F33BAD38CB08828CF50D8D52910760795B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062006, "uuid": "5f96cb4f-ab26-4c3f-91b5-11ac4f92c97b", "value": "f6243a15fa8eee8ee96b5e1144d461f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062006, "uuid": "0a12dfdf-579d-4295-bc48-18be94c51778", "value": "192:83mbPYCfMcrfOIuZmvKQxtzlSIVX6NOf1FDTejDMN1:DMCfrfQ6tBSIV1JTeUN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765062006, "uuid": "0a82aeac-bb04-43c3-86de-c524d58e272d", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765062006, "uuid": "ca39bcee-54a9-45c3-bbed-a4a232634c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765062006, "uuid": "3bcba3c0-2cb2-4646-93b7-1524e2b32617", "value": "stagedx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b71178-d268-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765000736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765000736, "uuid": "a8ecb723-30e5-47fa-9934-eaf209f75a12", "comment": "Malware payload", "value": "a57012ee964d39a123d4d30e05fa13ef", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765000736, "uuid": "9f848c08-5bd5-43da-a447-420a2b027c94", "comment": "Malware payload", "value": "bd363b590cb047e32ccae0989450ed8e2a77d0d0b7492c093debf94f72feb2ff", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765000736, "uuid": "9fcadf4d-4425-45c2-a699-7445fdbd5946", "comment": "Malware payload", "value": "8214e1f640f57db5a93962ddd79666f9b1f5dc23", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765000736, "uuid": "cd0c0af7-033e-4465-9295-31e05ff9994c", "comment": "Malware payload", "value": "fa344e960d69784e1302a5d56f36e609ed2fc97e722fe939a95b9f0fc0559de5ab09f87e33450ae041702859f37ef1d9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765000736, "uuid": "097c5023-615e-4f49-8479-6fc71e73a07b", "value": "T1347343895BCB85F89A37747586DF9C06F7D58403092CC7E2FE8DADA4AF21428A1F49D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765000736, "uuid": "86dfa3e5-986b-4c6f-b9f3-9a9d21b6a35e", "value": "1536:3uqkC09yseygns6QFDj9dyRwpFm/fHuEjxW3ho8M8PfbA8Do65hYckOtIB:+qkC09yseygns6QFDj9dyRwpFm/fOwxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765000736, "uuid": "fbda69d0-a08f-42e3-884c-35e42caf4558", "value": 76687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765000736, "uuid": "3215ad1d-b330-40fc-a342-d182ebd91371", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765000736, "uuid": "753c6a2a-3f75-481b-91ed-e67e02c04700", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67463e9-d2e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765055282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055282, "uuid": "9679ae6b-678d-4709-a7d7-3fb318401b82", "comment": "Malware payload (Mirai)", "value": "9e11029ffaed6ef1e0323f1fb76a5e84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055282, "uuid": "8e2ae5ed-b6c0-4323-ac11-6ee96289ba47", "comment": "Malware payload (Mirai)", "value": "bdb1d7583382ea951ebe241bfdd51524df5a96cc3eccddaa4af34ad2f0c3970b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055282, "uuid": "7490e4b6-0cb2-4920-bf87-35ee250a8207", "comment": "Malware payload (Mirai)", "value": "b956923f6785327e48c439686d91193c99b8a52b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765055282, "uuid": "ae01a52a-9e72-4064-80a9-87f7fa6e457d", "comment": "Malware payload (Mirai)", "value": "29e6b0dc4b3e50ee8b3f5466ae410fafe768ec3e4589bbd77ac70e46bd1598f45fffce4fa187f0baf3358e1558c00c07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055282, "uuid": "3e21bb49-5398-4d73-9e2f-b6e2255e069c", "value": "T14004E816AB510FBBCCAFDD3702E90B1139CCA54722A93B363674D528F54B54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055282, "uuid": "4ddaeec6-224c-45dd-85ea-ea158bcf0b4e", "value": "3072:Mwoe3spWZt9nQiX/GpO1SMRpp6NWJdWQmi:MnSs8ZDQiX/2ObRWoDWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765055282, "uuid": "e16e1eb5-94af-4916-adac-6ca2bec4c6d8", "value": 181968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765055282, "uuid": "946da960-1ea9-4ac4-9d13-ac6361e7eced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765055282, "uuid": "9ce84bdf-1987-4989-babb-91dc8b24d5a9", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e69ea88-d253-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764991461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764991461, "uuid": "f471a740-47ee-44db-8179-2754ea8d539b", "comment": "Malware payload (AsyncRAT)", "value": "b4acfa761365af70d2e7bb34c76a2845", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764991461, "uuid": "09c1d452-654d-456c-9e09-633411e1d5c3", "comment": "Malware payload (AsyncRAT)", "value": "bde1d12e4a9141145fc6a6f1d5aceccf8db3aa3ebe77a7c1e47f09f8ea11b37c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764991461, "uuid": "b44de35f-c124-4c58-b6c8-4e40cf559e58", "comment": "Malware payload (AsyncRAT)", "value": "f3fcd5e40c8417f51238de4fd3df6dc617a3464e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764991461, "uuid": "ab4e6ad5-02e8-4bed-8078-9bde6f04ef20", "comment": "Malware payload (AsyncRAT)", "value": "5b8ef33c394a2bf22d157f29bf45c031c2a92dcf481d28bd14a107dac01bd46bff065de1110775bd343234402f09e0c3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764991461, "uuid": "92d312af-ee89-4d19-8504-d60b840d5af5", "value": "T19B231A003BE8812BF2BE4B7499F26145867AF6672603D94E1CC451DB1713FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764991461, "uuid": "713f55af-a82e-4717-b7a3-f36f1d74fbc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764991461, "uuid": "391c1953-71cb-4b47-ad5c-43994946f6f4", "value": "768:vum8n1TQwtPtWUNt1nmo2qz/08eOcQ0HiDPIOzjbcgX3iN+6sHCiVwBDZjm:vum81TQq72m3iiMO3bzXSNGCigdjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764991461, "uuid": "084f2974-9e46-401c-a517-6290f5c35034", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764991461, "uuid": "f8d1042d-7819-4878-9404-616003b4fed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764991461, "uuid": "2d1eb9b4-b8bd-4bce-848f-bddde70db234", "value": "taskhostw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79555f06-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049622, "uuid": "fb4f599d-c9f4-4aec-98fc-9c0f9580218d", "comment": "Malware payload (Gafgyt)", "value": "60d58d5fc8f69555cefbf2f2fc747f58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049622, "uuid": "5b23866f-7113-4dce-ba7b-c82084d0d6fc", "comment": "Malware payload (Gafgyt)", "value": "be12e8cbfb19907e617d4c2651b561587f833dfb041dda9dd2aec9249b29a7e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049622, "uuid": "19e6f054-a2fa-4c13-b367-5e4693b9312f", "comment": "Malware payload (Gafgyt)", "value": "ca06e1e2c12eb7809222853fc28e2b5464a27914", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049622, "uuid": "f6982217-8772-442d-9123-c358dfdf2444", "comment": "Malware payload (Gafgyt)", "value": "619b5ae0dbf9411f8e057781f5adf0f1228668bf459d6090a682741e5e1803d846746b412beb16c64551719ba598992a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049622, "uuid": "91c943eb-290d-41be-bb32-c8269d438f26", "value": "T197057C9BFE5E3C07D2D7E27EAB4A83B0532BB190D31351627941032CD5C6AD8CFA1A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049622, "uuid": "731a9f4c-9540-4433-9daf-3d9debf0da8c", "value": "12288:M9QGvt7oDtJ3SzaSimpTp/CQlb6Ys5ptBQP3Opmye+5iK:M9ZsSzaSjRCQlUMTd+5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049622, "uuid": "ffc71a4a-0adb-4f5d-9bf8-6a8ab159c531", "value": 839360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049622, "uuid": "b5884f7f-6de3-43e5-b159-5b1c8784e4ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049622, "uuid": "72864518-f136-43de-895c-cd188e31bd2c", "value": "aarch64.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc47daa-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050058, "uuid": "53b5b473-c8e0-4840-9fbc-76b0246bf01d", "comment": "Malware payload (Mirai)", "value": "9fa6189ab738e81c8e67d495740a4e3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050058, "uuid": "b0f5dd3f-be06-4ecd-bcb0-6329543d7644", "comment": "Malware payload (Mirai)", "value": "be190781828de8abd82b8ff7a269c04f125105acffab78c523f327c90a1b4fc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050058, "uuid": "71e26e98-bc98-46ab-8628-718b08db3add", "comment": "Malware payload (Mirai)", "value": "f731b34d3d5e5f2bd05fd2eab03626562832b9af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050058, "uuid": "dccdda81-b3e0-4f8c-959e-44209cd7f936", "comment": "Malware payload (Mirai)", "value": "fc548d28d3e85a28887cb551b3813fa1874975ed9c00603d086a35b82fab1058b5304a76f5940cf45c659bb0b255cc21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050058, "uuid": "3bd1571f-dc8a-4ecb-a7b7-a123283b8fd6", "value": "T181030212D26B4359D08733301D6F3DBE77D4A4F9AA9838B05D08AE8E512763FB05B6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050058, "uuid": "014ce96b-8feb-444c-9178-ef5fb2dee2a7", "value": "768:j/Joy73n+DELfqOTasjezGgI5cRaf4c9f9D4D2h2zf3CNDlOnbcuyD7UtQRje:jWm3n+DELiaeaNSE954Dh3uOnouy8tyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050058, "uuid": "49e7bd71-bfec-4eb1-8796-1fecae2b629f", "value": 40352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050058, "uuid": "e252e90b-8dbf-47d9-9fc4-f2803f42e7f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050058, "uuid": "279c04b3-9914-4105-b0fd-5aef61626667", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff9b93e-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037661, "uuid": "d3c1080e-3a3b-42eb-9eee-025a9407b14b", "comment": "Malware payload", "value": "67b64e6d9852b5899c22e8ed8e1f3bec", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037661, "uuid": "4ee0dbf7-d514-442b-8e7d-3ff0235e448f", "comment": "Malware payload", "value": "be800678d3d743b98b46fa6fc65678eb4ef6cc05f0e097f3c37bc294c3b8a6cb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037661, "uuid": "8c0b5075-1758-4cfd-a0d0-ef385f18b1ba", "comment": "Malware payload", "value": "8f0f9793c1bc5100d2b8a42eeb1f117b6f36e23b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037661, "uuid": "9714b7ff-3a88-494b-9619-89845495032d", "comment": "Malware payload", "value": "107f4e850e3cd6af4b952b86a44de06eadc7cbfdd52a9cca4096cd6b6a9e8f5a193959f17d1f81e655b78e0f9bf4e87d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037661, "uuid": "b911df25-a495-4f10-ab8e-7746f1cf59e7", "value": "T127F7338297E93C2EE9B7C03687AD075A9A9D8C05C683C54B4C79B52CCAF7BC4C584BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037661, "uuid": "37c71dd2-d110-4097-89ba-15d1e694daa2", "value": "1572864:5XhwiYeVLySTOCY8eO/p2Uglx8HAs3mYsXC6Y2Uc8Uxm75eG7uCLn+8KBk:5RnNym/t/pyQLwJYQlGCCL8Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037661, "uuid": "8a750933-03a2-4d08-a3da-d3beb85f4e7f", "value": 72982088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037661, "uuid": "18c614f6-a0ee-4fc9-985c-a637ee25c2ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037661, "uuid": "f8b0f025-9700-412a-a1e5-9900e2b5d1aa", "value": "kaya918.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43028c02-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042230, "uuid": "37c45328-f06e-4392-a4f5-36126b82e135", "comment": "Malware payload (RustyStealer)", "value": "3a4703b2586411b43790d581aa66f472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042230, "uuid": "fe4a84c2-2e04-4ed8-a1e4-145164c1b381", "comment": "Malware payload (RustyStealer)", "value": "bf020108d0bb8147939fc917736a3110d829b7d59ade54f73a0e54bb1d7d8e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042230, "uuid": "ea3a6d93-7d30-4dfa-8ab3-afbcc8f69323", "comment": "Malware payload (RustyStealer)", "value": "703a9a28c2e889124015e4e5599f5c28407a4a4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042230, "uuid": "7b50cfba-3e13-437f-a9b8-fd70c4bba6b8", "comment": "Malware payload (RustyStealer)", "value": "2c549f662ab2fc9636b0b1d6421c08ebe769216daccb144a47e1e3541db72512a7cbee2506df6ef2bf7d9847bbdff7fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042230, "uuid": "25532a56-73d0-49a5-a1dd-1c76bc2a42a6", "value": "T125657D07F6A581EDD19EC0B443469E37B635B8890A20BDBF17D15A302EA6F520F1EB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042230, "uuid": "59c581cd-aa65-4bfb-8391-4a7069dc75e5", "value": "0e37c9d6bd6fe57a49b574a12dd7bfe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042230, "uuid": "57cb2f41-5a5f-486d-8f80-df7fa901f382", "value": "24576:iQMeXk4T4SnsZh7UkvVdnQvh5rNVx8S3QSVG8yI//D:iQHlsZh7UkvLCX7x8SgSQ8yI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042230, "uuid": "65db4d54-7870-414b-b907-da97e10ebcd9", "value": 1479168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042230, "uuid": "115045ab-dd66-4d9e-b9a4-f9e61b0b319d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042230, "uuid": "04e5cd70-b452-4606-abb2-29aa3424aff5", "value": "minimal_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5890cb61-d290-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765017785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017785, "uuid": "30a1aa6f-0312-40ea-9842-daa302b69878", "comment": "Malware payload (Mirai)", "value": "93935c062d0c12438b43d1fcd010fc64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017785, "uuid": "cfc95e67-ca2d-4719-9ebd-ca0e72a82e4b", "comment": "Malware payload (Mirai)", "value": "bf228521a22296c2f6b4d5b090c0661cd31a93417d51f9b95e8b71a19127ba6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017785, "uuid": "aec09144-a485-4813-8382-ce205d70c2fd", "comment": "Malware payload (Mirai)", "value": "52f8e3152cfa3fedc67245b00ddb622c44c95c39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017785, "uuid": "222221dd-0eab-442d-823e-b69152d1acaa", "comment": "Malware payload (Mirai)", "value": "c57a90591ada1b1b6a8146051ab7d863805fbc91eeee6c24dbc501c0382cc81b6e225457ba15cc991379bda3121b53bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017785, "uuid": "819d7a39-ccd6-4797-993b-994c9c176375", "value": "T1506302D0ED7F2967DAF8703BDEB5908AACE42EB2807A19561146437C5D372412F78E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017785, "uuid": "cea4f71c-313d-4f08-b6cf-3e8ac28ce70c", "value": "1536:buVPKxYS3IioJNRhe2rKpPzEtFbmliRKGlaU20LxRYeFrtelCAuo1:5xYSfohQdzE3+iIF0LxRFrtep1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017785, "uuid": "36b2b2b3-f3ae-4ad2-9ee7-58d7776479f8", "value": 72548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017785, "uuid": "6af87b4c-612a-4204-8809-60ded81cbe88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017785, "uuid": "bee0d339-473f-4522-9062-67154cd24095", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8fa9b5-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049839, "uuid": "279104e0-ba02-4ccb-a775-38e48f634781", "comment": "Malware payload (Gafgyt)", "value": "fbc940734532e7ee199b3acbd7949e9e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049839, "uuid": "d7bb3c11-d04e-4312-aeaf-4686b154666e", "comment": "Malware payload (Gafgyt)", "value": "c0013f73eebd96e83925817c83613892c20dfa3d819775eeafd4b0a82265ab77", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049839, "uuid": "911023f6-73ca-4ed7-b0f5-f6e77816e9b3", "comment": "Malware payload (Gafgyt)", "value": "b6005e0794dcd8a728c7c921092b63b18466e00e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049839, "uuid": "0951f1ca-4bfc-4f2f-9207-90fcd9ddadd8", "comment": "Malware payload (Gafgyt)", "value": "07aaa7b2eedf690f5522bde86e86749e5725e2bd9909671d1b5f2086b167b22a43a7af503b20865424aecf9892596810", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049839, "uuid": "fb17a707-83f7-4320-9674-d26a698ee2bb", "value": "T18C318BCB10551BF32C95E933336958C0B6C092AA98C29F4769DC3CE148BEDEC2845AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049839, "uuid": "81029ac9-a8f2-4edf-bc9a-845c0dc9faf6", "value": "24:v6Td8j62kCh6xUgI1B6fT66rC61W/6kL16Ux6HtcxMP:v6Td8j62R6q76fT66rC61I6kL16Ux6NT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049839, "uuid": "413f089a-82c0-4d31-bf73-919b912caf85", "value": 1449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049839, "uuid": "c8a9769c-70e6-4d1c-8a0c-844bfc9fc77c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049839, "uuid": "9aee42fa-9af8-41f5-a039-46c14508f4b4", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d9e4e0-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061208, "uuid": "f9de7973-0b0f-455d-898e-5074e40d2616", "comment": "Malware payload (Mirai)", "value": "64fc0046a707f5c81172ed9b7e7f3cb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061208, "uuid": "904ac86b-ec11-446d-b3b0-603cfdce3560", "comment": "Malware payload (Mirai)", "value": "c09b404a9bef4f1064ad1dc0f8c506feeaf7c9fcfed58cd97e3476a4039dc8be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061208, "uuid": "04a758c5-057e-461c-9655-9abfd4c6fa07", "comment": "Malware payload (Mirai)", "value": "b54601a6e1441465b2817a97adc8fc5cf6cac858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061208, "uuid": "1558f1d3-a26e-4330-a376-e6585cc56fa4", "comment": "Malware payload (Mirai)", "value": "bb499839e5ca918628f48a3b0867fe58c6e0b955c171cf0cd88cc86dfbbe806531b3e2f8ebb7d3b2121b86e73e91f711", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061208, "uuid": "71790045-3fe8-4f22-80d1-c46b6d109c5e", "value": "T13EF2E1EE9706759BE56E41704A7A07913F850A33D2F29C8F3C6E7687D9221BC3182BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061208, "uuid": "2810f9ba-812f-4358-b38e-0c2c12c84d03", "value": "768:SxPuH+f/xYArWS4MskvFR6Oc59VCIPSUkrIsJgGlzDpbuR1Jx:SxPuH+tWSk8b09VtP1kVJuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061208, "uuid": "a8479728-fdb1-4874-bd71-c9e77d718716", "value": 36356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061208, "uuid": "b18b5d0c-c471-412f-8222-5f00047050f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061208, "uuid": "24f26d6d-b8ba-4faa-8771-4601643531f9", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d209a4-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050155, "uuid": "496296a8-00a7-4202-aab2-a2eadacdd139", "comment": "Malware payload (Mirai)", "value": "d7742785875988fb2ae13ceb9aa591cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050155, "uuid": "15adecb1-e2bc-46a0-a3e1-f7a505532e59", "comment": "Malware payload (Mirai)", "value": "c0c21b6350119f97b0a9f4cea84cae8ab952a5a089fd4c308ba4a7704eb6eb7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050155, "uuid": "e336e433-ffa3-4ac5-a5da-c9edd405b539", "comment": "Malware payload (Mirai)", "value": "bd6aee2c205d380fe87da8f9e46ad57f8bc909ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050155, "uuid": "dcbe85e3-f8bb-422e-99a8-64dd0b50ccb2", "comment": "Malware payload (Mirai)", "value": "39638bd0dcf6d24ac8177d61c1fe51463502098e07e234a0a82e1fe9c3befaaed79d0640c598db180c8a6b2ef73ede16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050155, "uuid": "ccc20691-1b81-4f9d-98cf-12392ac5adc7", "value": "T1F4737CC2AB47C4F4EC2605712077E7728773E13E1029EE83D769AC32ED52A41966A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050155, "uuid": "768137a3-2cbf-4e9e-9452-5052aa144906", "value": "1536:IUQvN+2LhcKKFdWtGP238kvd8U75Je1d+5:8lV3KFdWcP23Nvu0nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050155, "uuid": "6a95cb94-ef33-4f90-a4d8-b225ac3feb88", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050155, "uuid": "2792f8e9-9dcd-48b7-a57f-d0f947ad97d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050155, "uuid": "bba2b903-36b7-4bea-ba56-e0a5376ff108", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763dfe8f-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049617, "uuid": "cdfb4646-6963-4c78-bb89-a646814be15f", "comment": "Malware payload (Mirai)", "value": "8ff9ba379518f03b2a14c549bb202432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049617, "uuid": "a2306787-da1a-4484-840b-60d2fed9959c", "comment": "Malware payload (Mirai)", "value": "c180de0721fa4ed13c416404dcd56f6cb8b0485c4a993df3089c049e5a2e7e0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049617, "uuid": "69745de5-1042-4d12-8b0f-4fdea4bc66f3", "comment": "Malware payload (Mirai)", "value": "fbc4d98b3275487b2160b4a2c2d2084a82f6bae9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049617, "uuid": "1d3d50f3-a560-4a95-9b1a-cf725a4c377c", "comment": "Malware payload (Mirai)", "value": "4b0ae350eab4266e491e5012a5ca47c9a1e66fd270329c395b82176aca26a0bdbf974908032370ee454556b4440f905d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049617, "uuid": "814eceec-c795-41f9-ba56-879f9a72a688", "value": "T16A153B06BF406FFBC4AFCD30492EC35611EDE9D756D5662A71F88B8CBA9D2090AC7448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049617, "uuid": "ec4a1a84-9f9d-4496-b14c-04e77609c0b3", "value": "12288:hMcpY6LYfNrRzvESks27RmDhP7bHDSdGMAVEuvaQ0EN3KJ/Hi6hBw2K0NmTDh1o1:nUNrRzvNfrSdya2roGLUOf2U0VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049617, "uuid": "f1e32829-922e-494c-a899-637d6160372d", "value": 891420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049617, "uuid": "9b327eff-e46d-4c09-a7ce-72fce1866f57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049617, "uuid": "13e41629-3f2c-4f05-9d53-4a19f0477f1b", "value": "mipsel.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57e0f9b-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048945, "uuid": "94b39ad1-2d33-48b7-9029-cddd9fdf192f", "comment": "Malware payload (Mirai)", "value": "2e781087092738c344889c6d174e8867", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048945, "uuid": "8e5159b3-35a6-4b1c-b106-ccee8db2abc3", "comment": "Malware payload (Mirai)", "value": "c2fc32c8d2c54307d5360da3adc377ab06b25c06572a8f68f36870968521827c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048945, "uuid": "8643f45d-9ad1-4172-bf7a-da553c1ab4fc", "comment": "Malware payload (Mirai)", "value": "5784f62e6128b157c866d8af1cf0c5eeff4fdde8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048945, "uuid": "0f44cc19-c6d6-4725-ba03-c9516f3c6b06", "comment": "Malware payload (Mirai)", "value": "cd3b43ac707a07dcfd73a8697faf642f9f6254348de52af09512a1b6d4c3c4abd08814c582f0f9f1c1684bf60f997c07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048945, "uuid": "0316a0fe-b2f2-47a4-a16a-3ca8363753c9", "value": "T1BAC39E32D8396DC4C1A45434F8B1EE711FA1A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048945, "uuid": "84ab862d-5d96-43e1-b92c-49011aa27185", "value": "1536:qaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKRZwgQaX4jnOsKigXIQSUwrVr1vwj:qf5Z5Z98XdmVMJa2aX7ziGSUGfIwEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048945, "uuid": "be7da6ff-c002-4c75-99db-113977dc657f", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048945, "uuid": "f66c4ff1-4be3-43f9-b71d-74bc5cb83582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048945, "uuid": "61d29202-6f51-400c-b7cb-4dd4fd8f25f4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03b5662-d2d6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765047970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047970, "uuid": "3ddd4649-f78d-4009-8598-a8fda9e0cd8b", "comment": "Malware payload", "value": "43b99dd5a0011d64636168d2597029e8", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047970, "uuid": "2df7cd5e-d562-498a-8567-ad7b281dd37c", "comment": "Malware payload", "value": "c41516c694145761cea2385a4547036538dd99c04619c9693b11da64a707b451", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047970, "uuid": "ad3cb78d-caee-4b13-b794-ecbdf7a7af2e", "comment": "Malware payload", "value": "8b7051dc8b76ca679b903dc0948afb47dcc395f5", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047970, "uuid": "a72c00db-4b96-4230-a758-abdaedc33b89", "comment": "Malware payload", "value": "a3660413118774c2951c8e0e845aa47ad0b43ffcfff8b955bfd4343454b1bb62b998c16ffc9666250b5478d1d212611f", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047970, "uuid": "fa4e8776-c551-41bf-ad67-bd6072c53426", "value": "T1ADF533191B09B838C9E6563E4DA7E2508177B3B694F93D2668DD0E640F367D0C7283EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047970, "uuid": "545c3f4c-0a4f-4326-8516-9bf511288f1c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047970, "uuid": "28fcf3af-a69d-4036-a1d9-f15666b154dc", "value": "98304:MmKPMrsbMNZ3B/5Sk3k/KVkDqVdfcpu+MVHbdgLouNwv:7rrn3J5SYkqDR7V7eWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765047970, "uuid": "abf72d44-389f-424a-8d1c-9c81ba280ab3", "value": 3620496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765047970, "uuid": "3b37c19f-2ba4-4200-8057-be00a767ca55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047970, "uuid": "aea99a07-50cd-44b5-bb72-5dde431ef1e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4185e5f4-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042227, "uuid": "89dba947-c56a-4534-8c9c-cc77833a2676", "comment": "Malware payload", "value": "47400a6b7c84847db0513e6dbc04e469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042227, "uuid": "1d9241a2-a20a-49c0-a96f-4b232ea4cbe2", "comment": "Malware payload", "value": "c4dda7b5c5f6eab49efc86091377ab08275aa951d956a5485665954830d1267e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042227, "uuid": "8fcad845-79ac-4d24-b373-76dbf286fc61", "comment": "Malware payload", "value": "6b7b8c3689d00b6b5daddab2c9cbc4582288fd1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042227, "uuid": "e740932c-5047-4a74-b526-406a486e330a", "comment": "Malware payload", "value": "d281fc93f996dc44c3df2fe79527cb8eca2765f128e4245348b2afeef56c8647388eb0ca6589ed3f75809b6965751807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042227, "uuid": "d2b130d3-603f-414d-bce7-3d89e5fa3043", "value": "T17D846B07F5A554ACD19AC078531A9677BA37F88E02207DBF13E897302F59E216F2CB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042227, "uuid": "ac26d3f9-8b14-43da-a380-cdc64b431159", "value": "87f7dbae89e5e69885842841d1b3b8de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042227, "uuid": "4c054258-8c00-4a10-8983-04b65c096256", "value": "6144:u3GaVBHER3ufi+5bjgmUR+D2cXoxJs8YV9Gg1BilWj2s24If6S+F2:BBO5bb2c47svVQoe65F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042227, "uuid": "b284b214-1f93-4305-b11a-618f8f0b3471", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042227, "uuid": "4de3e872-395b-462e-8001-ed7f43f340b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042227, "uuid": "856c2a85-2967-4ffb-9b9f-9952d7a8b1e2", "value": "lpe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f35113f-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049176, "uuid": "55b60c7b-8799-4842-8033-937d2c55ba84", "comment": "Malware payload (Gafgyt)", "value": "5791d67fc161d328ba028c9d597b2b23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049176, "uuid": "3f7d563b-47e3-4def-9cdb-bf5174c7d3a7", "comment": "Malware payload (Gafgyt)", "value": "c5928679dd8a4cc007d2155284d8a03f3d2005fc652edfec55545131822bf424", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049176, "uuid": "4b40c8ec-84b7-4d3b-9ef7-505e7a69dd1d", "comment": "Malware payload (Gafgyt)", "value": "96349bae710d480b2c295cd0759412413982a5e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049176, "uuid": "170bc314-9b25-41ef-9420-4851b3cdbea0", "comment": "Malware payload (Gafgyt)", "value": "035420c3c6d97be26ca5a795353246115627ffccb67b08c4356bb029e6d011728fb654d1a87364b6ad4df67a6bb68f62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049176, "uuid": "bfb65aff-b640-44b0-b833-aac871d659bf", "value": "T16E935D27B552C67BC08752B42BDBE9615823B4FC0B32324B73D47DA82B669C92D6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049176, "uuid": "ab37d44b-16ba-4417-9665-58464d9902e5", "value": "1536:o7elVRQpx5Stljh0ReyC1kM3u6a6WNSaXFKtnOIXmA+KWOXFseaZYxe:OSQpx5clddB1k4u6wIaV8Owm/KWOXF7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049176, "uuid": "79a77432-0042-4e10-89b6-a0524866ffa5", "value": 94711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049176, "uuid": "76a255b9-8bc1-4f3d-90e0-a200479ffbfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049176, "uuid": "0f1f67e0-ee02-4f23-8dd6-feafc76622bf", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724a842e-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1765037585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037585, "uuid": "c57c5b91-4c87-43c6-8558-1b42c38264ad", "comment": "Malware payload (GoToResolve)", "value": "fa27d0d9a2b9806936d01521072cb114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037585, "uuid": "2d424113-ddb4-4c7d-bd9b-1342eba5ac87", "comment": "Malware payload (GoToResolve)", "value": "c5d2655f3d5951267d44d36b2fa55a93126820fbc25168874a6c04eca2b9e702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037585, "uuid": "a7601858-f15b-422b-b886-f52b45415ead", "comment": "Malware payload (GoToResolve)", "value": "7f52fa67c54ee94bc2ef13b54bd31b61024d9e16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037585, "uuid": "31e73bd7-46e6-4273-9057-6a8217dedc62", "comment": "Malware payload (GoToResolve)", "value": "12e7c14f220c082df9f276884ece0b3c0a00d9e6508f75db375803e149d83639fdda74b255ddea2dcce9c52df2e4e0cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037585, "uuid": "1755a083-3950-45c3-8329-6d072c36fdb7", "value": "T1293733217157C032C99221B2A929EFBAD35DAD205BB519D7B3DC5F29A7301C32B32D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037585, "uuid": "7df7cd6f-74d6-4d68-a6ef-fc7dade9b96d", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037585, "uuid": "eff06b8b-067d-4026-a501-216f3e496a14", "value": "393216:q2mcrgZIm4fQoPl9CDyoC0CiLHOBp3IigWt3TWh5kCeSGhR5yZ8+4k:zgKsGCDy6rOvYigsjQ5khhho8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037585, "uuid": "2f763428-1344-43f8-961c-5f1b245c42eb", "value": 24443880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037585, "uuid": "4ba76c14-99f3-4e1e-b133-6f8967a8d603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037585, "uuid": "bc04e88b-0568-45e2-b743-b7f84618d67e", "value": "MicrosoftExcelUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de44c23-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049174, "uuid": "b6e0a00d-2a63-4819-b751-500d437e4e5e", "comment": "Malware payload (Mirai)", "value": "30386c15fd097f62b939930debcf8731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049174, "uuid": "743df44e-3aa9-44fd-b822-b43a778a157a", "comment": "Malware payload (Mirai)", "value": "c685707c97ef7926f1bfdcfba2c9aa89e8114b936fd33c7b14d60385c681da55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049174, "uuid": "be114f99-404b-4db0-b3e5-0d2801546f56", "comment": "Malware payload (Mirai)", "value": "9457ee346125589ffcb75c1bd1fe4e659cce7662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049174, "uuid": "cc0fb0c0-d971-4765-9719-5914ccac1cfd", "comment": "Malware payload (Mirai)", "value": "ec287a74a88f9b97740e717f7470f385b46aeecd8fc816a7eb2bfef0484fc82ccbc783df2dceb80b9c266d830b944888", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049174, "uuid": "77a6fd66-db9a-486c-bd61-bfe410bc1891", "value": "T1EED46D6377318FA4F361D67009F387919AA921A20AF290C2D37CC6107B5166D6D6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049174, "uuid": "6693d4b0-86fa-481d-9107-d90ae0cd3ca7", "value": "12288:dMAQyrHo6EA23+pSL4SxGL3hGx6WgpjlHIO3:aApVsgSL4SxGL3gxWIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049174, "uuid": "0ec9eece-54b5-47f0-a092-92c4611ab7fd", "value": 598124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049174, "uuid": "4b7574f7-0dc5-40c6-bb1a-1d166dfbeba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049174, "uuid": "60557a69-01de-4ad0-880a-f6d5c5a3d4cf", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcefe86-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043459, "uuid": "6b29abbb-b53d-4fbf-ba17-8af85cf43bd0", "comment": "Malware payload (Mirai)", "value": "900069d3b39014aabcf327e1a717d40e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043459, "uuid": "1038ac2c-7395-48c4-8af7-7850436b2472", "comment": "Malware payload (Mirai)", "value": "c7e40b2661aa777be8db078b1aaa94029c9638a291be2cad44cbb3b1a3e07344", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043459, "uuid": "b8b9fd99-b788-4ae2-87b1-e5893e2230a3", "comment": "Malware payload (Mirai)", "value": "118b97a217349959a04eb26e3e807d09167b05da", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043459, "uuid": "d18276f4-8cca-4c18-b7b6-0ce292826aeb", "comment": "Malware payload (Mirai)", "value": "ad329d1599af1ccc91cca479fb928544b819c98bcd1efd28baf241856ed195fa0099d327cc63e7dee3ea2440e11e74d4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043459, "uuid": "7f271aa2-d55d-4499-bf0c-42854389c92c", "value": "T193F0AF8D0223682602588E0A3429D502D74BF3C0BBB12F4EEE1671AE6CD460B701DFCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043459, "uuid": "2d430117-e92f-4a1b-8088-8d4b749af41b", "value": "12:6mxq+hURH+h1NIjlTBA+hmiKl2E+hQdKA+hB9q+hp0q+hHh7IAUn:6mxhUw1NIp1bKlW33BjqHmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043459, "uuid": "02ac4baa-4f64-445b-87c5-2698d08d69b4", "value": 575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043459, "uuid": "133e6aa6-7edc-4b75-97e0-3e6dbf7ea32a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043459, "uuid": "70dff5a5-a5b6-4575-95b7-137a46f34cd9", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7187371b-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061206, "uuid": "3df01ebc-0591-42ee-8d43-dd3d8218ac86", "comment": "Malware payload (Mirai)", "value": "2e9a036cffbdc7258e5fa3d522f86b09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061206, "uuid": "bc98a8d0-8541-4b19-a16c-269dd65b785c", "comment": "Malware payload (Mirai)", "value": "c851868f834717fa007d8229c38c83487d0a1fae77d75a5ccaa407a3466a23a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061206, "uuid": "5bcc956d-76e3-4923-ab60-4ecb2ca0a803", "comment": "Malware payload (Mirai)", "value": "5d1cd1acf4a886ed995bbf7059df408456073123", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061206, "uuid": "ff0f64aa-dcb1-4d6c-8d16-8e4c58aedd15", "comment": "Malware payload (Mirai)", "value": "8075a67942737eeb07c76e5487e0715ef63b1bb7990b03ba247a6c55edf8b374c01c543378202f83c8522c9511507529", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061206, "uuid": "72ff4aeb-831b-429c-9712-5f6c5531d86a", "value": "T1D6832AD7F401DD7DF80ED77B44630A0AB270A39106931B366797F9A7FD321A54822E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061206, "uuid": "061e29f0-ef6b-4a5a-ab8b-ef7de2437257", "value": "1536:7ta7HvDDi6ssAxiDI4081yYSFikrXrahsUzv6Nfzn1HXhMniJ0kt:Ra7Hr50iDI4fyYSFJWhVzvKphMnw0kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061206, "uuid": "7920a497-d494-4e7e-a368-cebdf26939be", "value": 81592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061206, "uuid": "85a517d0-7145-4a4b-a516-6a6c7253cdf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061206, "uuid": "d0972781-eeb7-4bf7-8a5e-932d0dd2fab7", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518df097-d2dc-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765050415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050415, "uuid": "a79ee7ba-9f53-486d-90f8-35553097267d", "comment": "Malware payload (RustyStealer)", "value": "926626d0d66c89e6427883cd93084589", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050415, "uuid": "0edd1e5b-eca8-477f-8c15-fd08840f2141", "comment": "Malware payload (RustyStealer)", "value": "c88f36ae0c516191d722cc66275db2292c1535f786462af3d3a9eac3a1eacf86", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050415, "uuid": "f7a757b0-490d-4fdc-96f0-0a22f15f964e", "comment": "Malware payload (RustyStealer)", "value": "31b2531dd082b4e3c6c6a44f129964fe892a3462", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050415, "uuid": "0a1a34ad-b64d-4489-944f-bc110b7a95e2", "comment": "Malware payload (RustyStealer)", "value": "a7d09bfbf2dde5181b2b42863e3059f0ea9cf6bcc7b10742599c69d823a4259306e80a60125e650a023cf7b0593e3cf6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050415, "uuid": "35c0ee5b-3c1d-427b-9e66-9e9873336fa0", "value": "T179C49F97F1A26DB8E227C0784217F17B6A3975852122BF771BA8C8306F62FC16F09745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050415, "uuid": "59a95272-da97-4908-b5e3-245f232c4c55", "value": "4d0baad4973da8341e14b651526cb4db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050415, "uuid": "6b3c52ff-59fa-4bc6-9aba-fe37758c9177", "value": "6144:l8QWm3cW4D1ehvGivs8KU54R+14pxyvOIDOPfLMCQacjeyxcWcpmPkMo3U:ljFQi0K4pxIofLBojPSWcykMo3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050415, "uuid": "000717cf-a5dc-46ad-af88-a39c1ae87d41", "value": 571043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050415, "uuid": "9ffa958a-2f44-4744-9c4e-c0bda81ac3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050415, "uuid": "4ca17cc7-6dd1-4570-bdc1-61652d4634e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892fdf1f-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002404, "uuid": "61db6f39-73d4-46d9-a779-e7a881d3b4ae", "comment": "Malware payload (Mirai)", "value": "0d163796bf97605324992e526a8e239a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002404, "uuid": "77e115a9-d69c-4d5b-911c-96b84ddb547f", "comment": "Malware payload (Mirai)", "value": "c930277a07008e99d1612260fd9c9ca9c2999fb7fb29a0034d7685f20d7ba566", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002404, "uuid": "5f90882d-16bc-4d69-93cf-856131fe9af3", "comment": "Malware payload (Mirai)", "value": "f172163c1582fbd2de825069d6506c2e77783bd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002404, "uuid": "87aa4d11-d5a9-4d33-aec3-b8fb56996bcc", "comment": "Malware payload (Mirai)", "value": "f04a7f72ce64fc3efe3666b69079f2bd4095a908f9ffbb1bfb208b1c9abf3d13b73f06ad2798e61bc5d329cb14e96379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002404, "uuid": "ca0f3ae0-e62a-4185-810c-3a0ae73e5a47", "value": "T18FE3D70E7E319F7EF7AA823547B78E21925833C623E1D585D17CED151E2028E241BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002404, "uuid": "b82336d1-4c0b-42a2-81be-64e0b7c541b0", "value": "3072:JMlXpkent1VVO18fdx44+Z06jwK95Dh91uGR/q5Ds5:JMlXyent8Ux44+ZVj9PDHj45D0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002404, "uuid": "f28937dd-acd8-44e4-b904-4cb10df631a7", "value": 156932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002404, "uuid": "346835c0-30c4-4471-87c4-b218b8f97d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002404, "uuid": "62f196c2-a85b-47cb-898c-b4a90bbc693a", "value": "colonna.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767fa6df-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049188, "uuid": "d8c120ab-60e1-4223-bd57-39a8a3c810c1", "comment": "Malware payload (Mirai)", "value": "462696ba5138ec0284ce635f00bd7e0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049188, "uuid": "3c760f4b-8b9f-4437-ac69-6b64f58c78af", "comment": "Malware payload (Mirai)", "value": "c97c37addc3bf3f359472190e4eec9b464819462cd1abe832dd96b80db216676", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049188, "uuid": "9266b946-95d3-4188-88a6-5b6e02aaf475", "comment": "Malware payload (Mirai)", "value": "b27db2cc2bcc21ea0cab7e74a9f8eb4cc534ce80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049188, "uuid": "d57c611b-dafc-461f-b8fc-8cfbcb26eed5", "comment": "Malware payload (Mirai)", "value": "51df30195c7c49a8f537e08db2bd8afffb1d68b5f2bdead30efe0999ff0bf5100587939bff38197fca2cb6ab86a86f53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049188, "uuid": "37053d90-7440-4faf-ae71-ae8a16e0f78a", "value": "T19474E046F7573D82C9EBCA39088AC645875AE1A723F3834A2707597B3C193778F29349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049188, "uuid": "3329c7ba-85ae-4b13-b29d-117e218b581b", "value": "6144:ZzM6kXMrxiCx6SdDAhkBJbhIjBjq+4YbQ3E/lvMpEgpjmaQ:ZLrV6SdDB4Llc0/lvVgpjmaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049188, "uuid": "ac88ea3c-fd0b-45c9-8ec3-695a40099115", "value": 361652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049188, "uuid": "115fa430-6822-4830-bcce-bf63d18901e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049188, "uuid": "1d3c684e-5ea4-4a22-a9c4-5ead6418e526", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b4b6e4-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042199, "uuid": "254ea2aa-0661-4ee8-b973-388e4ba1a703", "comment": "Malware payload", "value": "042c341bf822a2acc4977395032f3b55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042199, "uuid": "3ade6c98-8ef2-4759-bbc7-1f7152dbf379", "comment": "Malware payload", "value": "c9992209339d05dd934b99298cf35da7ac9d152c6d0df200258d636bcfc7de78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042199, "uuid": "ea893195-27b9-4aa5-825d-dac75ca5600a", "comment": "Malware payload", "value": "e145a9cc536bc220d483af29c04ac16f642cb9ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042199, "uuid": "423f5c44-7c10-4331-937d-a1e56507caa9", "comment": "Malware payload", "value": "25b3f80d471461682130cb7455ef4aad008788242134832c5ed1440f9f7d808153728562147e6fa3e88d6bcff1bd86ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042199, "uuid": "30583727-e2fd-43a8-9d1f-22a199a13ae3", "value": "T136857E07F2A581EDC09EC1B48347AA33BA36B4890520B9BF17D55B703E6AF554F1EB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042199, "uuid": "6b44fbe5-4b24-4de2-b4c6-5c4d2520480c", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042199, "uuid": "956522f6-486e-4c74-9b03-160ece2a0ce8", "value": "24576:n9vapvCc6P4vk9NpZcAGSykQWUxbmLtjIQRoG3tPm+8cB/I1:n9vapvCc6AbAGSykffLqQRF9m+8cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042199, "uuid": "fba2c539-ae3f-494d-af45-1d16fed8b07e", "value": 1713152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042199, "uuid": "d682d7a2-5217-4fc4-ac95-403ca85a7987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042199, "uuid": "493b7181-c1d7-439d-a631-89e89e4c8aa5", "value": "enc_fast.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99971c6-d29b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765022645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765022645, "uuid": "5b7c6dd2-b708-4ea2-ac6f-44d67043c56c", "comment": "Malware payload", "value": "00a38efd746bb33dd6c3709983832d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765022645, "uuid": "ff89ddbc-2444-4113-9ddf-3217a8eaa8c2", "comment": "Malware payload", "value": "c9aca0cf9b1edcab4813ee44d52297f5d525343afe807b950e1bd998870a9a0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765022645, "uuid": "1b94cfe7-75d5-46ce-aa06-54c5f8cbc928", "comment": "Malware payload", "value": "e7a92f676ac878daf47b38db099d47060d61821d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765022645, "uuid": "2cf814dd-a075-4dfe-a050-2eb6e465ef69", "comment": "Malware payload", "value": "f3071060f83006d7f8207f1cb9f1963c579e9aef4a5a87e96618e983b5a0d6d75f002f96e4660a96ba5ec3b12f2f1238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765022645, "uuid": "be654919-1678-400e-9b7f-cc68694c053b", "value": "T110858C1AAA5C40E1C16AC138C992D94BF6B17C144F75DBEF0A60571E2F37AE14E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765022645, "uuid": "52f43153-2b71-4ca6-a906-6ba28fec0773", "value": "12f3b7f462c8a9197db6e4cf38c1556e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765022645, "uuid": "eb9dad05-152b-40d0-bb10-887a91eae228", "value": "24576:QgkkecO2EcBrBsTih3oeWBmlEJxXkStLZkcs6wa8PIRtj468:Hk0OXcBrB6ihUvzXZt1k36wxgRtEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765022645, "uuid": "4aa7cd4b-fbe8-4e3a-8fe9-cbfdf79e33c7", "value": 1738888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765022645, "uuid": "8973bfa7-4d72-4b85-be50-011f1a13f84b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765022645, "uuid": "af9dbaec-7d36-40be-ab60-cb9cdff72db9", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c37e461-d2f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061197, "uuid": "a2270629-18af-4e8b-a25e-0125a69c46e3", "comment": "Malware payload (Mirai)", "value": "18a08f662eb614bc911aa997d6b5ff33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061197, "uuid": "d564e980-26e5-4070-b1a0-56689eac658d", "comment": "Malware payload (Mirai)", "value": "caee3441f0840d7b0126d59334fb25f1937e07593d5938256c612b98573aa1b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061197, "uuid": "5f9d7786-66ef-4e62-88e9-0881c0510590", "comment": "Malware payload (Mirai)", "value": "7adbd1ea8cc8805f352c937d5615766398f9404b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061197, "uuid": "31a16d34-71e7-4b11-b837-a029bd819240", "comment": "Malware payload (Mirai)", "value": "a4e7326ee671080b5a8825218c975a2af458c2193e86563a438a6ec1deb85096c8286ca6b87c1c15aca8aa435b43463b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061197, "uuid": "70472000-c694-45cb-bf44-ee2613cc7b42", "value": "T1AEF2F122219F3512D2B1CC39DFBD895852A543F9C0FCB672C05815ECD78282D75F6BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061197, "uuid": "792a5a7b-4ca1-4860-ac66-b9155c26820d", "value": "768:s73aiQKtubTOlop2v6NEcdmVvQ0THFZR6d9Gpfexhus3Uozp:s+EuXOyM6KFVvQqlv6d9amxFzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061197, "uuid": "eac16eeb-d76d-4807-8fd2-a8dbf24db6b7", "value": 35056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061197, "uuid": "67f50cac-9b62-4516-b50a-08e42f3991f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061197, "uuid": "ee9e4cc5-8d08-47a0-a513-7b1c4a6c772b", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307aefa4-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006121, "uuid": "fdbd6838-5bf4-4392-873c-d06489037b2b", "comment": "Malware payload (Mirai)", "value": "d138ff6b2e54c89de6eae1fd45447a8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006121, "uuid": "b0b74782-7c2e-4ff9-8440-3365c9bea35c", "comment": "Malware payload (Mirai)", "value": "cb413da0f6659ab5a4741eb7233d0772847048b94bdd0cf83db33d97f63a3458", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006121, "uuid": "19d5ad0c-aae2-4f2a-a635-4dc9efd56887", "comment": "Malware payload (Mirai)", "value": "fa49399f5cf17f6cc58d87b0adf97ab5fa862dc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006121, "uuid": "95cb865b-5087-4448-b35d-6a1b0ac98b86", "comment": "Malware payload (Mirai)", "value": "1a6db87dbddf5e3c2dec044fcdfeadf545c75c0d76aacaafb762514f6c4d0438039e513bf35b6bf53721ebeeb2959bd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006121, "uuid": "4f919889-412e-4486-81df-0f28170c5881", "value": "T14193F888EA47E1F4DE0B4C305057F23F8731BE11C934DEAEDF84AF56E963922A409665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006121, "uuid": "cc240fd4-c14a-4287-afe7-119e7522d2fe", "value": "1536:+G8WAH9Hsak1Cva4F4rSWDIxwQDYAl5rWYSnbqSIU631ks2UcBNAWr:+FHsa4CvadrHIxwQDYuKrqasM7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006121, "uuid": "893222b8-df12-4b63-9535-c33457b7736a", "value": 90760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006121, "uuid": "787bbe73-43c9-4ed3-9c58-b6c715256790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006121, "uuid": "48164007-66a1-429d-81b2-49835f618289", "value": "h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795ff09b-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050052, "uuid": "0d45eb54-80c9-4b38-b3fb-17a348ede7d0", "comment": "Malware payload (Mirai)", "value": "5230694881c1275ace7df146d100105d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050052, "uuid": "b1ad90b2-688b-44a7-806a-177f2827780b", "comment": "Malware payload (Mirai)", "value": "cb8c20768e4f5aff94c23be80dd93a39b5b701881ec6376d0f5ffe8cf9c6dbd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050052, "uuid": "e3505168-0d20-4028-b2fc-d5d756df8988", "comment": "Malware payload (Mirai)", "value": "90d9a63cfa4028a66b1f005544a22a25e5f94f89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050052, "uuid": "79575372-e7ff-41f6-a6f1-7d3dad696640", "comment": "Malware payload (Mirai)", "value": "5d5f66eb1d7474c4cf325f6d778573dd84b4c2b8b7e7de4e026e9d8d652711b126a265a99f0d924d281659bb4e06494a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050052, "uuid": "addc4b27-697f-48f5-a657-9f2c4e0441da", "value": "T16613027FC5D63A87C07C99BA70CD223A5945F8FA3A4F4F0D9B209880531998FF8E6059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050052, "uuid": "6e08d34f-1bd4-432d-8d3c-5ad4aeaa621a", "value": "768:3QG+TUIlpoE02wCvZHI/zw4Jp2lktVfVUfxzSpts4hN3ToTFP/BcMTXWS:gZlpoE02w4ZHms/lMVfVVfs4L3ypWMTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050052, "uuid": "04a53349-0536-48c2-a484-1187f7b0aa06", "value": 44132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050052, "uuid": "8201109c-cf20-4b84-9b83-48fc298be687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050052, "uuid": "0847d8f0-1152-485c-a654-42771729041e", "value": "nwfaiehg4ewijfgriehgirehaughrarg.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36054428-d25f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764996681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996681, "uuid": "8852b011-f006-42e5-a0ad-21d086b9aba6", "comment": "Malware payload (Mirai)", "value": "52802f659a1cdb266de1fd269a5b9c9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996681, "uuid": "f4bf62c7-d01c-4275-b531-3c16a10611b2", "comment": "Malware payload (Mirai)", "value": "cc15e14c8ca1ddd8eb0ab17fab92a7cdba83927f8d85b1d9852006081a30799a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996681, "uuid": "cd00ad50-5b1a-4b54-9c25-26f451c5635d", "comment": "Malware payload (Mirai)", "value": "373fe555310b2656e4c7868cd27db8b055c46465", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996681, "uuid": "de48c377-4272-4cae-8bc2-155d6881583b", "comment": "Malware payload (Mirai)", "value": "57fc919b661beb6558655793c22a474418cba4b65ecae91fdaf7f84f3775e408469795ef59ab6e57549b7251e90da64f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996681, "uuid": "920f519b-23e0-4123-89db-4c2c259653ff", "value": "T1A6932B09E924872BC3D227BEF79E524E33272B54A7D773119A347AB42FC179D1D29021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996681, "uuid": "e885e8b6-d66d-42b1-bb8b-4741153bd39c", "value": "1536:nMn4pMMy3GVx0+YPEc1edrDYGtUQUMtizCB/WF/rSKuVxAGrFfSjAErruLQTR8:eMyWVx0/odDyCB/WF/VufrorQyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764996681, "uuid": "57f5055d-5147-419e-9f8a-3ce005da6cae", "value": 93138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764996681, "uuid": "74e0c4f9-d0ba-4345-ba21-9f1992e4ddaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996681, "uuid": "845befdd-dfcb-4d81-95a1-9ecfe44dffdc", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23e09a5-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006366, "uuid": "fe348305-9f9d-4584-ae5b-a0bb82a63ba6", "comment": "Malware payload (Mirai)", "value": "48fc3a29c2431a17b73cd0e680c34179", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006366, "uuid": "22d43165-03d0-4743-a32d-ad222fae4dd0", "comment": "Malware payload (Mirai)", "value": "ccb8d863aee96b7b1dfe4c4fc08cc459a11a0efea5a7477562e4564f992282f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006366, "uuid": "0e98cd28-edeb-4061-856a-51a0142369ef", "comment": "Malware payload (Mirai)", "value": "98307cb29ada461d6302e33b0550821b6e42664a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006366, "uuid": "da0ce487-d2ad-417a-898d-8e01591b21d1", "comment": "Malware payload (Mirai)", "value": "793d1e8d612d23cbcd8cafcd1fe57784675bc2ec66f1ae6c803a63b6e79967f4ab6edfe75a9fbad69a967678f65fdefc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006366, "uuid": "a6ad5e34-cd9d-4061-9f38-ee542886dd69", "value": "T1E811B7D516B1A372DC58DF0CFEB0491CD01E27A6E4DF3DE446CA6A992C1D90836A8736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006366, "uuid": "2401c544-022f-48a3-acdd-16e083e2f76a", "value": "24:20vWvZkj0ORo0KN80KN80yHycNbXbPb+bSbd+:2OsujUogJbXbPb+bSbd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006366, "uuid": "c9349875-b818-446e-af71-7a4c905ba231", "value": 1028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006366, "uuid": "c83c34a7-a3fc-4ab0-9be1-11d21397b3ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006366, "uuid": "c26ff3f2-0518-4669-b667-2afd535dca4c", "value": "yrn.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a94c96-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003127, "uuid": "7269817f-1d0b-4efc-bfac-57eac2646145", "comment": "Malware payload (Mirai)", "value": "54ae7392bb2fa495598537fd25d1307c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003127, "uuid": "370f5416-2684-4d45-a1de-10de660dea7c", "comment": "Malware payload (Mirai)", "value": "cdcbee742bb68d4685527fd2a8546471089d24cf75e5c60d21566657d4085f22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003127, "uuid": "f568e6fb-ad1c-4989-b50d-ae7415ee5bd2", "comment": "Malware payload (Mirai)", "value": "d7b8c5d2b8dacb2ab929b5d9dccad2e4d0ad448c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003127, "uuid": "b1ee0ee3-d992-4366-8309-778a35563d30", "comment": "Malware payload (Mirai)", "value": "a965ccf4a81141b600220efe25e7d61d38e61ecf80ba8a8296af5f656282f73233134d31753a24294f12a3e8b7c75940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003127, "uuid": "7957eff1-1cdd-41eb-ac8c-6aa8080892d1", "value": "T1D704855B6E10DF29F75C973046FB6D28834A23A72AE6D64AD18FD6001E7131E5C0FAB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003127, "uuid": "7fb198df-a3ce-472a-b5a3-b098558c629f", "value": "3072:0S9IlE1bTh8PpPHwon4grukQ2KgrUsefN3IAcOVwjEN7R2eFb1l9WG4HO2E:0ZE1bTKRPjJrukQ2KgrU4qBN7RXFb1ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003127, "uuid": "60b9c7f9-d47e-402e-bbe9-8da8ec0fd8dd", "value": 183592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003127, "uuid": "0590e0ed-9b1c-4d36-aa63-c9aeb261fa60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003127, "uuid": "6d9094c1-80d6-41ee-909f-b41fb534d0ab", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7938580-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038667, "uuid": "643ccb99-be20-4130-9f9c-928750b9fa4e", "comment": "Malware payload (Mirai)", "value": "9651874111539104742a38a0625acd4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038667, "uuid": "72a16ad2-6895-47f2-9066-e8cebb885d6f", "comment": "Malware payload (Mirai)", "value": "ce02d1d15f466f39b73f61b73d60e9e51c8828f58b75ada7b700afe57043c63d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038667, "uuid": "abae4d29-d0a3-4bf9-a50b-e633b4c57199", "comment": "Malware payload (Mirai)", "value": "69fdf5db29800e768a5ab9e48b7efe5544ddf86a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038667, "uuid": "eda51071-7880-4c84-a200-4a61fd61349a", "comment": "Malware payload (Mirai)", "value": "5d82118419554770cfdaf690768d2234189be79d0f75c30bdb78af8fcf6a20d1ecae56db841802e709e271f496d66108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038667, "uuid": "60485115-f3f6-41d5-b9b9-be962ee3537a", "value": "T147243B623A791B17C4E0E53A51F7931EB2FA178D29B8C24F7E520D4DBF58AA031532B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038667, "uuid": "f6b2fe1b-49e4-4f91-9d43-628fbf18e774", "value": "1536:MvkbW4phrjASYf2VUOGz5EJbJvfBrM679SHU/bs8x9MU22g1K7MRAIXh:aUMSYOuDKJbhZVJTs+9/2Q7MRAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038667, "uuid": "2fb418f4-2ef8-4fb9-ba59-e14d069a0dcf", "value": 230012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038667, "uuid": "6266bc4f-e246-433d-86cd-cef753c5a485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038667, "uuid": "6790d8f8-2102-4660-a04b-b18419b24fcc", "value": "n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fe96da-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043470, "uuid": "a1d818e9-bca4-490a-9483-350c0cd26df0", "comment": "Malware payload (Mirai)", "value": "44f2d87ce683e8ca24848d5c720ae40e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043470, "uuid": "e5da69ed-6ead-4379-b2ae-61193d810bc3", "comment": "Malware payload (Mirai)", "value": "ceaa03b6f4af772673cec68345b571bf9ac6187cd73d27d65df8b6529cd27bac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043470, "uuid": "e2d01832-8e52-4fe2-be82-672b5cdb4966", "comment": "Malware payload (Mirai)", "value": "de811743e7189d7e10cc80768c02a143eb3b74ad", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043470, "uuid": "efb4c077-5f78-4566-a628-92b43abcb139", "comment": "Malware payload (Mirai)", "value": "c2c8a4d6344c77f43d97903861b6cd52b32d1a226bb4c66139954b12a28c3b986963e68838191dabb40e8da2d81dd750", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043470, "uuid": "ddd2e9d5-fa9b-4e04-b402-6bce96d36e73", "value": "T147F08C8C0222682713688E0AB42DD10AD446F2C07BB12B4AEE2661AD6C9420B701DFD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043470, "uuid": "e61cdb56-8a59-4325-998f-ea23f2f5d4c3", "value": "12:xnmxqxnURHxn1NIjlTBAxnmiKl2ExnQdKAxnB9qxnp0qxnHh7IAUv:hmxWUH1NIpKbKlF3sBY5Hmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043470, "uuid": "d64c1d08-b896-4f20-92d8-39439402b256", "value": 577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043470, "uuid": "278dd3c6-d10c-4667-b37b-27edad354188", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043470, "uuid": "4e5da933-31f4-41aa-a1db-7e75c3830524", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bfa524-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049620, "uuid": "d516f2c0-5ae5-4222-8664-243b4517a4e7", "comment": "Malware payload (Mirai)", "value": "8a866e45546b5c41cab8c04ef7ad2a2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049620, "uuid": "60f22132-90d3-407f-bb45-514d5cc348df", "comment": "Malware payload (Mirai)", "value": "cec1b93759a23a46eb6d36816420eba15f33afbefe92a3f7495415e27bd548a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049620, "uuid": "bf6c7b9f-8035-417f-8e9c-fb0fa23aac88", "comment": "Malware payload (Mirai)", "value": "09f6d1b5bf67f86ec98501d56346cda78d0b7865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049620, "uuid": "817e894c-7918-408d-92ba-607fbea5a7ab", "comment": "Malware payload (Mirai)", "value": "4a8b98ef9d1257b842b48fc2d24c90ef42292bcb758f59ac9c8cc1cc35e448ad98ff4c05a7568d869c6474fef65cf916", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049620, "uuid": "603a71a8-a5d6-4965-a6d9-66a73e56ac3b", "value": "T1C2357D5AF2F374BDC057C030839BDB626835F46515322E7B25C4D6342EA6EA01B2AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049620, "uuid": "f19ffd6a-02bb-459d-a9b6-2ab85f40ff5f", "value": "12288:09NtXnZtkGYESJEQA9o5yIzxzxuII6ULmy15To9aE5kjxIziPc6L:09NtXnZtkWSJEQAe5yIVzpULkILsiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049620, "uuid": "a4e8a387-8afd-47da-8c5f-0c5e97282629", "value": 1152312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049620, "uuid": "eaec62d4-db4d-433e-b494-cf9f1658a528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049620, "uuid": "75852b1b-4b84-44fe-8297-a3e2b58427e2", "value": "x86_64.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac39206-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042189, "uuid": "3b0840c3-9a1d-436c-ba10-6bb83ddcf293", "comment": "Malware payload (RustyStealer)", "value": "564f8a84d1cbd107d5e0cff632967ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042189, "uuid": "47957557-58b7-45b5-a0ad-e0b9e664cb1a", "comment": "Malware payload (RustyStealer)", "value": "cf010c57d465e0bde7a9d5f351aab442bdfff49c393be0bb139185df8a0248ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042189, "uuid": "ab7f6a46-a4d6-4adb-8703-03aef21686ed", "comment": "Malware payload (RustyStealer)", "value": "262e43dcf42ba7e102999ce5f9832461cb488350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042189, "uuid": "3eb129ae-a4a3-40fc-867c-3306afdc1353", "comment": "Malware payload (RustyStealer)", "value": "bf42cfe79dfea5ec5efdaa0f92672fa28c30ba7b7caa914eab89c3b2f391d69e2f83e92e1600eb5e6c58b3037bd78542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042189, "uuid": "9678fd55-6aa1-4337-a162-2a57dd3f98b7", "value": "T161159E1BF695A2BDD55AC0B493068A72B536B4CA0621BDBF01E1D7343F96E620F1CB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042189, "uuid": "f41e1e3e-29ba-4ef9-94cb-b8ebddb85334", "value": "87f0863ec927249773659ca301d7b700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042189, "uuid": "f7a5d0c9-fbfe-44b0-9137-4064991b905e", "value": "24576:uH/Ls1S7APHLeQWzxfybcolpt63SEo86M/DS9:uH/Ls1EcfWzxqbcoLt6y86Mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042189, "uuid": "8eec83e3-6d55-48a6-9c22-7de6244cddf9", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042189, "uuid": "5813f9b3-44ce-4e19-9aed-03d12396b7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042189, "uuid": "a4d97ebf-b17f-4e8a-8c10-7cfd03469620", "value": "dec_victim.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780b9917-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049191, "uuid": "3912c9a3-6f8e-479c-89ba-dcdf1fccf9b1", "comment": "Malware payload (Mirai)", "value": "4a80ff06d1de46db0deb3dd69040b578", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049191, "uuid": "c5993a32-6b84-4e6b-92e7-7db36068710d", "comment": "Malware payload (Mirai)", "value": "cf45d16b7937490e602c619aa8ea9e1b2f4eddddc7c9c61c0e8936513d45c0e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049191, "uuid": "0b591bb1-a3a6-4e1f-b7ca-475b5cd8c047", "comment": "Malware payload (Mirai)", "value": "50708ef4c24b91c636090a47109e1916c01599ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049191, "uuid": "6b99aa14-a32a-4d8c-a13b-5844b42d9a05", "comment": "Malware payload (Mirai)", "value": "bed689a9c57937d89f69cea906b3fc6efc2843eea035331e1d759ea8b07eacd708e29530682628b9c7c2066d0ae114e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049191, "uuid": "e590fc05-2f05-4775-90ee-4cbc9f392c7d", "value": "T1CAE43941FB1C0563D9431DF029BF83D6F3257A5240F89239331DAB5B3621E7A998778A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049191, "uuid": "bc87c4dc-8c64-41ee-a1a2-193f40cd7515", "value": "12288:iJQjtneN4bvwqxga5qCEVEmNrDPAaZSqipRO0ji0:i5Nkvwq3Y5VEkPPhS/jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049191, "uuid": "0162fd21-05ae-4310-9dc9-68d6ad13c52f", "value": 660388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049191, "uuid": "d92db4c7-c628-4b92-b4df-a50ed68bfd43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049191, "uuid": "a66b7dc5-cac6-4141-bded-b6aeab25a209", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36be8b6e-d25f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764996683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996683, "uuid": "ecfc478d-3219-43f5-8b43-12bedd18e09f", "comment": "Malware payload (Mirai)", "value": "18ab27e0839cd63d4a62c07e89f7e00c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996683, "uuid": "21d76dfb-15df-4413-bf58-ca9fef4b2ea4", "comment": "Malware payload (Mirai)", "value": "cf6b5a6a4a4e74aeccad61bb7e367d816d247c7f0a5f4ddbb7e4c519328843e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996683, "uuid": "7c3876b6-4292-4149-a50d-dad8ac6c0977", "comment": "Malware payload (Mirai)", "value": "0000198e8f8f9fd833ca891fc5820328e586a49f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764996683, "uuid": "5606ec29-37a8-4690-b074-4dc7cb4a2d53", "comment": "Malware payload (Mirai)", "value": "b9f966ecdd9fad4030b293d24862c117c12c2d64706f6ed1bb2a623149cfea152bed4c37e7696a537474147a191eed7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996683, "uuid": "1d644850-b6fc-4532-a0f7-69c25957d3df", "value": "T174F34C45E643C6F3C9830FB612A75A664732E8295B2FDE49F32DBCB45E064C8B109778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996683, "uuid": "1d2a491c-5d63-474d-819a-d2dc7b7f514b", "value": "3072:HXK0fxA0lDtiIPrFI942qer3+7Wm08Xg9lCbDvgq1s8NH:N5Aqd2qer3+6m08Xg9lCbDvgq1s8NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764996683, "uuid": "1e65f87f-6368-41d2-9aa7-240a75474c12", "value": 160904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764996683, "uuid": "deaa2366-2771-442d-8df4-6fc26ca7e7b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764996683, "uuid": "3343332f-a94e-4608-a721-4ba82b474797", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9a5a3e-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011916, "uuid": "37f1c49a-f6cc-4823-8a16-e82ce152d517", "comment": "Malware payload (Mirai)", "value": "fc1d89a224d05bb24744f4887497549f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011916, "uuid": "3b80cc5f-4150-40bd-98df-2fa0c8a8a414", "comment": "Malware payload (Mirai)", "value": "d08d7e0b05ea3a3ef2b2018619abc21410066b643095aac67a037033fc1b7a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011916, "uuid": "321fa602-285a-4b7d-9fe0-01dbad217d68", "comment": "Malware payload (Mirai)", "value": "b0c5d91b5b3fb929dc577f98babcf37e97b886da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011916, "uuid": "eb9f3af4-5fec-485f-ad0b-6176956d0f78", "comment": "Malware payload (Mirai)", "value": "1fec6cd16cd94cc054a8a7d440de2a86960fa17eb25b9c476a16a484bb474ffca5c2d63da7aa31321f72bf36c36e814f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011916, "uuid": "1068f532-8cb1-488a-9126-fe4b7169a369", "value": "T15143B80E3E618FFCFBA8863547B38E319648339622E1C545E15DEA015EB034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011916, "uuid": "0c794df5-5c4e-455b-b5b7-9579c24f69fd", "value": "768:CGfdaDYjKLC28rdFTffcAbncANQTPCRU4/sPgOA/9X5oa3v8p0a1JclYFtJgpRwN:TirqrdFTf5n1RUu4aX5oAvslsp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011916, "uuid": "0369a4de-2eb1-4839-bbac-6c868ca2daf0", "value": 56020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011916, "uuid": "2abacdd9-df59-4d64-b86d-57f1f0263ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011916, "uuid": "c167e9d0-2f26-4ddc-bb5d-a68a15065772", "value": "hoho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ae68fa-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042254, "uuid": "10be2f06-3f42-4558-942c-97b85c3f0b85", "comment": "Malware payload (RustyStealer)", "value": "fa536bb2c2fb3c5854400e81c5dfd573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042254, "uuid": "6790e66e-58dd-412f-aa62-8f4fc40abb21", "comment": "Malware payload (RustyStealer)", "value": "d13b83b603770ae7665f07a215c734db8397465552d389bdd5dbdf0fda17b0f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042254, "uuid": "c911bc6e-3146-461e-ba57-4bf6e3865991", "comment": "Malware payload (RustyStealer)", "value": "76e24e0f406a4527f984277073a3ec282cf59629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042254, "uuid": "e89f3a50-eb6e-4829-a9fa-bd15ce4af2b5", "comment": "Malware payload (RustyStealer)", "value": "8b260039125dff9034a389a30301be5a2a0484fcc362cadf3da8b917659376634b2c74eb7dc27c91aaa45b425e1b46ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042254, "uuid": "e9d5d692-25af-4512-af88-25b0ecead363", "value": "T1C7857D07F6A191EDC09EC1B48347AA33BA36B8890621B9BF17D55A703E66F514F1E70C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042254, "uuid": "5a193614-2cb8-4ad6-8529-fa201c3ad6d9", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042254, "uuid": "5301807b-91c4-4614-b79b-9d2ef269fd65", "value": "49152:DuFNTOCL6v9SGSyoGoJhZnCGdT184Bvfd8jUe:CFNT8SGSyObrDQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042254, "uuid": "6f2c29dc-ec1e-4a6a-bfc2-7264e661f10b", "value": 1709568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042254, "uuid": "423f7d55-43d0-478b-a57c-20d821afbd51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042254, "uuid": "4ae22632-bdae-4df9-8fcd-d22ce55086e8", "value": "panel_test_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8871acfb-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002403, "uuid": "3cc4df36-1718-4c8f-b920-db78117a7cc1", "comment": "Malware payload (Mirai)", "value": "90c4d9b507be4a68a6646a38fa3121e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002403, "uuid": "efbaf981-ad4c-48ee-9136-f15f98c62f63", "comment": "Malware payload (Mirai)", "value": "d1f458accc68914bc3af6468a1626c7608de8d764267ede5d9795219a05f1340", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002403, "uuid": "4d541ab1-106e-4284-9d88-26c87f9cf608", "comment": "Malware payload (Mirai)", "value": "6f154bb82f06fff90727e1d214cb99f3e7b05df5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002403, "uuid": "6a7d0eaf-207c-4e66-88c3-3b5654a9a6f9", "comment": "Malware payload (Mirai)", "value": "7ee2f04db285e1ea2da1784ec8b0f817cc4cadf662d4f7cd4c47e1018fcbb842525d73402711809e16a0cc4f0941a83d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002403, "uuid": "46b80579-91e0-4585-826b-8bd152816d6e", "value": "T1E0C34C9BF8009EBDFC5AD57A40174E09B53063A42B920F37A65BBDA3BC320E5590BDC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002403, "uuid": "b5ba9dda-8b6c-44eb-8136-6b9ff10d0d3c", "value": "3072:mbcael6uM81EsV3Rz2bM6Tfx9aUYxApyb2+cJP0jkfeOy0kf:Kcp6uM81EsVhz2bMYfE2pybHcJsjV06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002403, "uuid": "12104c63-5f55-4455-a21d-6aa6411dff8a", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002403, "uuid": "03312abc-2b5f-414d-a52a-c25f2e2a206c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002403, "uuid": "d24d9adc-90b2-408e-9d47-87deb01561dc", "value": "colonna.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bf91e9-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006123, "uuid": "a48e7f00-8bd5-409f-b0a5-294238c8ec8c", "comment": "Malware payload (Mirai)", "value": "219af2a341c8399f631668dc272c75d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006123, "uuid": "b5f5cb9a-2dca-4dbb-9307-785dfaa471f0", "comment": "Malware payload (Mirai)", "value": "d1fd9402f6466b9f9b4524cfe3ba1256fb5fa55e827aabc223b326888220bf93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006123, "uuid": "8dde8c63-c94b-453c-a0fb-500f80f75a74", "comment": "Malware payload (Mirai)", "value": "756a362b8f9522e0cabd3b28afd4a93e910e74f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006123, "uuid": "e6f00955-a244-4c11-b6c7-44dfdf327cd5", "comment": "Malware payload (Mirai)", "value": "24848ac34020b1bcbabb4416fda5a21009cd693b90bb71d26bb5b69ecd0364314f84c105ddfeb550683184816e44a5e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006123, "uuid": "0bfe5cb8-6033-45b0-a5e2-4bd277f5993b", "value": "T1BF3100D4AAE05E6DD9D182FF8C5D03587352DF4AE2D77612A20CB3689D1EA5CCD1B00B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006123, "uuid": "e0a9dd0d-5b72-4249-b111-70620b0a7b7f", "value": "48:7GJZo/6DIzagCpFaFaX8S0OLBmtBa4eX:7Qo9WFaFWAOLEtBatX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006123, "uuid": "8a1c1252-b3fa-4981-991f-990ba84a0270", "value": 1776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006123, "uuid": "955d95c3-5c52-4684-bffa-41970b05e452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006123, "uuid": "aa41827c-0a4e-491e-9e49-eacdf10ab3f4", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa1daa3-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043504, "uuid": "2bdc0548-1ba4-41f5-8398-4c808150a5cf", "comment": "Malware payload (Mirai)", "value": "55fa2f1eb34f6501c1fecf24d152f16a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043504, "uuid": "3b32f4ee-6794-4eb2-ad61-3fd5f4d68b1b", "comment": "Malware payload (Mirai)", "value": "d21d740522612a0a16de245eaecc17ec0f34520055c1a75b706187632c777b72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043504, "uuid": "52877176-731c-4c6f-81f1-97fe2b517bea", "comment": "Malware payload (Mirai)", "value": "f02163ab7159e4edf4879435a1c314359f1347fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043504, "uuid": "4e501308-e272-4f84-a2df-51d993e6db88", "comment": "Malware payload (Mirai)", "value": "1f731478b520690f5971214e83e4b19ca654de9aae6bf2b5629a8570c306e6e1697678ad9e32a0cb726f08613ff433b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043504, "uuid": "81103f58-bb2b-4480-9a52-933e88114df8", "value": "T1A1F2F891B8825A2BC2E423BAAA6F518E336173ACD2CF7717D8111F507B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043504, "uuid": "1a82e98e-6f1b-4953-8989-6c79e6d5abc7", "value": "768:CzQJzX74uXq3GpKWKKZSo2Tjupjq3e+aEreg6MjG:RXJXmGH2T+8SEregA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043504, "uuid": "4f08e11a-ee12-44ae-bde5-47231920a2da", "value": 37120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043504, "uuid": "6d2a4064-df92-4007-8e34-04b3ff719fac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043504, "uuid": "26b1feb6-4bb9-4c38-82ea-2118cd60b207", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab74daf-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981630, "uuid": "bb116cc3-ce2a-4354-9909-7bcdbd3044fe", "comment": "Malware payload (Mirai)", "value": "b80ef2d68a5b06feab2aeea816723aa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981630, "uuid": "d4863c1f-d21f-44cb-a8b6-7bd43311511d", "comment": "Malware payload (Mirai)", "value": "d2b83cd52fe2b24e675b5291a15052c043b2a4b7e65dc3ba27206bb60b20d611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981630, "uuid": "bd99f620-6ee9-4f17-b420-7b2c028a6a87", "comment": "Malware payload (Mirai)", "value": "1dfc8f1f9e41e630ce6c5e2fdb5c697ddbb1dc46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981630, "uuid": "91212fe7-e937-46c6-bdef-bdd5f038a642", "comment": "Malware payload (Mirai)", "value": "16dcc21345a8bae06f5e7e81fa5ea649b43a528f1fb9a3bac637e93e49d6bcede4f1e6e40bb7e578a58ecefeec3df699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981630, "uuid": "8fca2a00-1803-492d-b703-9e2b135851ab", "value": "T1FFC3D80D3F219FBCF7A8923507B78E269259338637E1D181E15CDA016EA038E645FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981630, "uuid": "1181661d-0da0-47bd-a427-2e7ef6988a60", "value": "3072:qlxLIzz7CkDvBigUlc76OWO+hapKiSwwZBUq:qlxLIzzukDvBxW/Oh+Ix9Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981630, "uuid": "d34a0410-789a-45cd-95ab-768148f1a51c", "value": 126144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981630, "uuid": "7b285bb9-de86-43d0-a5bf-826fa1b27b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981630, "uuid": "c4fd1265-8cb5-4b9a-827e-4b2046b25d85", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cf3cc6-d27d-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1765009519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765009519, "uuid": "0e190d5c-14ab-4c11-be16-0a464267d810", "comment": "Malware payload (Socks5Systemz)", "value": "a9878fd5f3155c14e06e4d3625a9eb6f", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765009519, "uuid": "381bf388-ed92-46e4-98fb-9ebd8b423794", "comment": "Malware payload (Socks5Systemz)", "value": "d4f62f4b8409cc4d8be3363a24830de0a733141f6328aa24406e03455ef73a99", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765009519, "uuid": "0ee7220d-6eb6-4957-897e-20b872a295c5", "comment": "Malware payload (Socks5Systemz)", "value": "9090dcdf3c400925c181280d465d1f68381ed2b2", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765009519, "uuid": "8e14c790-18c5-475c-89e4-7c985df4bd9f", "comment": "Malware payload (Socks5Systemz)", "value": "21e38da4acc6f776b70de414814392868383aeee292404ae686dedd03185e133aad09486195d0afd1bd9dfaa1cd15ec4", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765009519, "uuid": "f870a570-7236-488d-b1da-22bd04798e09", "value": "T1A2F5331B9A0AF8BAE0774539CE14D128A937B7D3593468782F89295B6FFF049204B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765009519, "uuid": "bdea3d0d-dfe6-4818-8b19-8967322b47e6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765009519, "uuid": "e4fbc928-7c88-41c3-8ec4-6a1c166766d1", "value": "49152:C9GfVmxXFrF5xpmz9omgrkVR5Fa+M0BHkDRAJLJXCqLYB2B8Jnk02YMt9h4V1RhG:MG98FZS9om0WoJ3DeXCXp6GQEV1LNwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765009519, "uuid": "11f9f084-b054-49d7-9775-dd14116aeb39", "value": 3576670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765009519, "uuid": "80c4fbe7-101d-4ce6-b7cc-97c8287f3844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765009519, "uuid": "25ac9c91-25d9-45c1-aa42-3774ece8d7ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a044800-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050053, "uuid": "09714021-2c41-4c7e-a260-e8a6dd4acf3d", "comment": "Malware payload (Mirai)", "value": "1cca9a2e8aeecb87a37d17ed748d6f3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050053, "uuid": "5f3a6920-28fe-417c-9806-7e4170fd78f1", "comment": "Malware payload (Mirai)", "value": "d5e4ffc2e4c397856efe92f8a482932de1262d0503657cb1334fab456cae3208", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050053, "uuid": "28cacd7e-04c2-451c-84c8-bb8d9d06caf9", "comment": "Malware payload (Mirai)", "value": "c046c11e3182b673e87ede7b0347cf50daa205be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050053, "uuid": "15fac4e1-85f3-465e-ba01-2f185793f6d7", "comment": "Malware payload (Mirai)", "value": "8550e2561021e83c8e53000b0d2df7f151d2564fb887ad8742f9ad646652a46f11143c2e13dfcd76ef0f4679d5e0dd79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050053, "uuid": "82f91da4-5628-4340-a447-26802b7918dc", "value": "T161B2D06504A52862D372183EFD32C68B66A041B9D0FF732D962446A4FBC1A4F56FC9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050053, "uuid": "71b86162-4cea-43a7-a822-0738814a2e22", "value": "384:qi+WJIPA2d6J2CUdfKp91LnGGOxqpgPZtJxU0dq/RCX0WW52UVpiRChymdGUop5s:vaeKosGswKtJxTqpCXRKpi8s3Uozs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050053, "uuid": "4ec94c10-6c3b-49ee-8a5b-476b502d0ef5", "value": 24052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050053, "uuid": "464e7963-599e-42cc-a665-e63ce0f7d683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050053, "uuid": "be5275e0-f984-43e7-982f-63e5d3ffdf94", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8345b25-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033836, "uuid": "c960db70-55a3-4ac3-a665-84bb8db30878", "comment": "Malware payload (Mirai)", "value": "6096f1ac302f1677fd0147bd2330a203", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033836, "uuid": "8bf2ae89-7ddd-4b90-b75d-f82f010f9594", "comment": "Malware payload (Mirai)", "value": "d5f6c8d7d5ae33af1e7ab5caa0cfe9f34863257adc1e45792ad0bfb1b1099ef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033836, "uuid": "b6603833-2246-4d6b-a4e5-ed3e9b7d256b", "comment": "Malware payload (Mirai)", "value": "dddc04a31e92add74f9b76e92b4b3daff135a641", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033836, "uuid": "d8ad5453-812e-40ab-b4d5-91419805c211", "comment": "Malware payload (Mirai)", "value": "975fbbf5b15d1bbcd3bf9da64beee520a3e0abe7aeb2d21d8822766455a71be4bcd8809a758bc3eb4d000e932f0f4eaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033836, "uuid": "ff66081a-9e15-409c-bfe8-566fd67ac6b6", "value": "T187237E73C8AA5ED4C6944974E228DE3A1733D418E2972EFA5A078676900BFDCF0093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033836, "uuid": "b3228105-f7de-4d7e-87ab-22093d5ece6e", "value": "768:kBbYO9FeDmjkDCUVOhr9rLoCQo25NBFCLpiD/:ktT+H1VOhr9gs2ZFCLpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033836, "uuid": "324eeea0-5504-43b3-9a8b-add2bad451f4", "value": 46116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033836, "uuid": "b505d6c2-df6c-4278-8435-01943fb3c361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033836, "uuid": "dc7a9692-46cd-41db-a84c-35bf7a15bab2", "value": "b3astmode.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4421ac2-d250-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764990424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990424, "uuid": "19f38f80-3813-4a74-ac47-bb5d1f7727e3", "comment": "Malware payload", "value": "0cb83ff2117ad5473e1b5943b992032b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990424, "uuid": "0463556a-711c-41cb-90d5-91c675be73aa", "comment": "Malware payload", "value": "d680e2a0429145c94a62fd0a3c76fc7a54d74e9d72016794db4900a191457b8d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990424, "uuid": "e9cb3846-0ad7-4a60-82d7-626dbb1081b4", "comment": "Malware payload", "value": "9b5a39569a1d2a5d97e48bf1e912e411909d9897", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764990424, "uuid": "2689f1a0-5052-4cee-a705-d483468afd64", "comment": "Malware payload", "value": "4996d4ea16c73df044f73ecb1a2e0921cf9aab7a6e5985b54ae0e13163a9c0ee2188feb318043bfb626b24e7fbf87f93", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990424, "uuid": "0fd254c5-181c-4f20-b894-4547aca2e57a", "value": "T1A6D533A17A68536AC693F674037847C093DAFC29E53700ABD52DF68E22B43E370645AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990424, "uuid": "8ce5fcd8-edb5-48ce-bc49-52c2dfa882b6", "value": "49152:dgXfghKrnPQzjY7dX/HzPlqNQsHG5RaMX9DrCvnaccz/oU1kuAd6xUghG:G4hABX/HzPEq50o/unJcor62y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764990424, "uuid": "15edbe8a-70f2-44ec-b607-f03ad3449c77", "value": 2879488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764990424, "uuid": "599a7375-9a9e-49df-889c-e3ad6227c907", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764990424, "uuid": "a41ba745-226d-4cc3-bbac-698094017cf9", "value": "formulario_agendamiento_citas.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ea5694-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042176, "uuid": "8834ddf1-0e36-424a-a437-517a26d888e2", "comment": "Malware payload (RustyStealer)", "value": "7c5493a0a5df52682a5c2ba433634601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042176, "uuid": "734c7cc4-618c-44cd-be3f-1f3acf0f8be1", "comment": "Malware payload (RustyStealer)", "value": "d73c4f127c5c0a7f9bf0f398e95dd55c7e8f6f6a5783c8cb314bd99c2d1c9802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042176, "uuid": "5fab4567-57f6-4bb0-b711-340f800b8c97", "comment": "Malware payload (RustyStealer)", "value": "29014d4d6fc42219cd9cdc130b868382cf2c14c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042176, "uuid": "91399342-2c2d-49c1-a7cc-7da5a5493199", "comment": "Malware payload (RustyStealer)", "value": "377b9918ab7280e03187c9af6e5c2671530dc8b7e801fe5d9297e7edc40f0893f1e0b6b99f0eb329b382c19856a0a124", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042176, "uuid": "a5117b8c-2230-4e6c-af6b-bdb69dd35b5e", "value": "T1F2159E1BF695A2BDD55AC0B493068A72B536B4CA0621BDBF01E1D7343F96E620F1CB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042176, "uuid": "ce9e896c-85e5-455c-8a2c-cff5e2c81809", "value": "87f0863ec927249773659ca301d7b700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042176, "uuid": "8ff60e5f-01c5-4be9-980a-dc1a02c44baf", "value": "24576:FH/Ls1S7APHLeQWzxfybcolpt66SEo86M/DS9:FH/Ls1EcfWzxqbcoLt6x86Mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042176, "uuid": "b91317f8-d942-4c2a-b6ce-06ebef835782", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042176, "uuid": "599b51fc-a6f3-4640-abe1-11cf5bc7abcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042176, "uuid": "9c7cfab4-b2b4-4326-88fa-4eb33574a5c8", "value": "dec_fixed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c90c7b-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981625, "uuid": "b8803e1a-291c-4a30-a605-ff0c7b4886b8", "comment": "Malware payload (Mirai)", "value": "39c75ed2bcfbf91caa5dd629cd4a7511", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981625, "uuid": "f4717d68-0e26-4973-b5b2-20c7d5470d7c", "comment": "Malware payload (Mirai)", "value": "d7efa8b0025b66be19a911c9ceadef61bd39faa94135cdc707faa7b09142690a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981625, "uuid": "05021612-cd5f-402f-b3b2-5a20b454254a", "comment": "Malware payload (Mirai)", "value": "450360399a9a476a5d222fda0aea5911aa012e05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981625, "uuid": "b57b37b0-be37-4811-957a-bd5358bb0071", "comment": "Malware payload (Mirai)", "value": "a7733528b2e8519b61f60678a7fc340f16b6cda4d2fc312a0d4dd13c8bfaac05239195e6b0ee5c6708fd64d6cbdbba4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981625, "uuid": "53f0567d-cb2e-4612-8ff8-6436f2311bee", "value": "T1975309917CC29A6BC6E423BAF5AE518D332063E8D1DB322BCC516B1477C551F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981625, "uuid": "7416df99-2dca-4a8b-a977-e4e683219e62", "value": "1536:YdBG3AMkNm3wofDZzNd2TmBzEGILP8nYj2io1+Snu8ubjXEMlUoh+gjrieY:Y+3AMkNm3wobMjMVgUMlNhLj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981625, "uuid": "11a0609f-3fc4-4b1c-a2dd-9f49c68e9148", "value": 63768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981625, "uuid": "d3cadc48-3763-449b-b096-d6b977fd4cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981625, "uuid": "18cef5e1-3390-4f81-853e-5cda88e9781f", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385d33ac-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042212, "uuid": "13b3beb7-30c8-497c-ac98-952a92475271", "comment": "Malware payload", "value": "59011f6a6c53f79b9d63d53b3ea7c251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042212, "uuid": "862dbf58-89fc-423f-a00f-f94f90a81aa5", "comment": "Malware payload", "value": "d942896e56eb6dc83c8788c92e6fe7c57ee419b9b092f3089c74b3f0e181b154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042212, "uuid": "424c4dc3-eea4-435e-9382-8efc133b7688", "comment": "Malware payload", "value": "60654d763e8918a10a5df9eb65b2676bd4e2a85d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042212, "uuid": "24e4ea46-acc0-4b48-9d9a-813ea10b67b6", "comment": "Malware payload", "value": "54a83a9e07ea33fc6b49d14173a710315f0515da5ec0188e9e5e29de6677d9ebd8f7808fb969f3c2f683dacfbfe7b56f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042212, "uuid": "e9ad45d9-663f-4c2c-9bdd-f12479bab154", "value": "T1D0858E07F2A191EDC09EC1B44347AA33BA36B8890621B9BF17D55B703E6AF514F1E709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042212, "uuid": "a33504fd-d12d-4fab-9e56-5a92dba7cd36", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042212, "uuid": "9c20ad70-3c18-45ae-a7b9-123ca6db61c9", "value": "24576:h9AtIFCL6vGvkMCoVciGSytugAx9N/HEWf3fCeM782I/SU:h9AtIFCL6uwiGSytzS8Wf3fDM782I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042212, "uuid": "5dc18a4a-80d8-4dc3-90ea-daae9c8ce1cf", "value": 1715200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042212, "uuid": "b765983e-836c-4cea-88ae-ec9130941f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042212, "uuid": "9fb65060-2499-4620-9a3e-a3b65b62c271", "value": "enc_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b74592c-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050055, "uuid": "127c6cc2-78ee-4a58-a7a8-fd74c3a63eb4", "comment": "Malware payload (Mirai)", "value": "91e7bf0805319e46f808e2058b2fd654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050055, "uuid": "cee68f0d-f7fd-401c-9345-c8e02f172a31", "comment": "Malware payload (Mirai)", "value": "d9769f65e7515c41733f8859f79a852cfb339498f0a9b57b0e76868394961c45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050055, "uuid": "91e2d6d4-c79a-42eb-ac10-fb66d715efa2", "comment": "Malware payload (Mirai)", "value": "c2f898f260307790ae842f9072e63e60471a3a29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050055, "uuid": "45721552-e9a8-4ea8-a3a2-cf993b55cceb", "comment": "Malware payload (Mirai)", "value": "7cd60668b9e8315c7bc1eb4cbc52abda2ec8060b2f5f2442cb2bf18328b2a63b3a62caacf4e07cd156ba22ef45077ef0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050055, "uuid": "f91f215c-5e14-44d7-ae66-410ec4841da3", "value": "T15903F1DEE6840A90FE6F8D2526E691917F920E3F77AE0D9090D476610EC742FB302DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050055, "uuid": "08262cba-9675-442a-bd6a-f2bf16ee18ca", "value": "768:42kydOvGx6jKxo9YzPpNH0D5Xa3T18BJeLwtRuPl0EhG4uVcqgw0IV:PddOvGxdouY5XOMe0tRsmE04u+qgw0IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050055, "uuid": "577bd8d1-ab34-4756-8732-7556641a22f0", "value": 39960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050055, "uuid": "cfe68ff1-cf3f-4725-b8c2-ce2a11f8732b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050055, "uuid": "99035d16-e924-4221-a71f-a85f845f6e82", "value": "nwfaiehg4ewijfgriehgirehaughrarg.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2904347-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050121, "uuid": "5a8c3188-ac2a-44a8-b429-fdd58bd22e04", "comment": "Malware payload (Mirai)", "value": "63d3c5e5508ebeecdb255425f72648e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050121, "uuid": "88b48f8f-8884-4ac6-bed9-cb2c40d8e421", "comment": "Malware payload (Mirai)", "value": "da1d0c22aea57ecb6daa0d43fbae82b3daa98efb28719c33f643ab934d5ec33e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050121, "uuid": "ac7dedf0-4a7e-4167-816d-ba6a8b0edcf3", "comment": "Malware payload (Mirai)", "value": "590217328e6c274b40e827820159722f236c7fd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050121, "uuid": "335c801e-6a01-40f5-9b9e-fd164ce5c579", "comment": "Malware payload (Mirai)", "value": "49b67f2afd4f023a7fd00944b902a70b2755caff210a244f385195c76756cbaa531c21944fd37f13cf88aa908ed9036a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050121, "uuid": "29a63070-6232-4ad3-9afd-4f7f28cd4106", "value": "T14D8329C1BA8BC4F5D80748304067F33FCB32E53980A5D65DEF6A9E26DE376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050121, "uuid": "3092e5cc-21e8-475f-8ae7-73ceec74ae3c", "value": "1536:UMpfl9OnpbStfCaWRW4HIWRawsK2oXcK6W2EFI9c:Vt9Kp2tfZWRBgXK7XX6TC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050121, "uuid": "f33be5c0-ee42-4697-93d4-712b0b52b084", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050121, "uuid": "69fc24f4-e916-4149-b4a0-49bad3882831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050121, "uuid": "1f2be1cf-04da-4f73-a69a-98e33c38dfdf", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a0c804-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042150, "uuid": "fbc67d28-faa6-4cd3-a394-d29c78fd417f", "comment": "Malware payload", "value": "3fcf6d5a2506d35b4aa0306c11607896", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042150, "uuid": "c44f18bc-ffd0-4ef5-b46f-72409b1b76c1", "comment": "Malware payload", "value": "db60f004b96b5adf202b62ddc57ac866cee1be165539095e31d2e11981b2f84a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042150, "uuid": "5e643b20-aebe-4688-af93-0abd909d4b43", "comment": "Malware payload", "value": "5104eb25426c4279552f2d3571cb82286c5888a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042150, "uuid": "48de8805-a2a2-4093-9b8e-857ebc948148", "comment": "Malware payload", "value": "fd49e9db1d4a48ffc99bc7b27d2f0aa7b2793c2e6f1e2b3fe1b14b1b63cd3d28bec95ffeabbe8542755fd138456a723f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042150, "uuid": "1366d3d0-f088-4a9f-a539-794476d299ed", "value": "T15372D70633F84224F1BF6B396DB205695972FC7A9D31EA0C0CD9506E09B2B84DB60F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042150, "uuid": "ba1fa61f-1c2e-4d22-83e4-be144bbe5433", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042150, "uuid": "31fbc2b6-155e-4f72-b86b-a7b0dda0c58e", "value": "384:YaM8+lCO/5vgdW3cSZE97Zw9QOlg9cI3STt9fqKycOnz:FMtn49GQi2Ky3nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042150, "uuid": "b8a2c45c-69bb-4eab-8bc6-1a03737f11ee", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042150, "uuid": "c615324e-263c-41ea-a29f-479fcc6a3927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042150, "uuid": "e815506d-c2cb-49b0-a8b4-4acb50a9a220", "value": "agent_fw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef3fea7-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049847, "uuid": "fe7cdce4-9be9-4148-b3a4-ac7c5af1018e", "comment": "Malware payload (Mirai)", "value": "362570dae2b677b9e3bd63d0dc3e1c67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049847, "uuid": "9dfb8fce-3848-4a14-90d0-a3462b7ae669", "comment": "Malware payload (Mirai)", "value": "dcac0e880a7acea113b14caac135993c73981e93c2a8576b35f17dbfe0edcaca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049847, "uuid": "7e9de948-7d81-4f1a-998f-5a93121f36f8", "comment": "Malware payload (Mirai)", "value": "5962fae32a25f15ae1dee0226666d58b870d0919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049847, "uuid": "8947c793-a926-4935-867b-fc3b8f613dfe", "comment": "Malware payload (Mirai)", "value": "9fb0efb6888eb4054f5a41009d6b76c6297c7f6e1a496b56b8f185da688045db2dede422a212ac046b25e4a06c1f5cbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049847, "uuid": "4555cecf-8f60-4a48-bbdb-4b74df65c4bf", "value": "T1A2F44A15F5D09F62C9C2257AF69E825833230775D3EAF30A991487383B979BB4F2B205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049847, "uuid": "9ef56759-ff3a-4dad-880d-90e4efc1631b", "value": "12288:6irS0XbU5EQZ6SSTWe2SOBNOVnlTAY0GkYodPXzsQAL6MN/oPXD6OsIV9C7Q2EbZ:6iJUqQtuqNOVnqVfpPTUIV9CL2CQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049847, "uuid": "12bd4884-53d8-491a-bdfb-9cf99f1509bc", "value": 749036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049847, "uuid": "28d2395d-2cd7-4f4c-84ae-9d4289c5ed8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049847, "uuid": "7b2459ec-1c76-4e3e-bde8-07da4a546cd5", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2f5d0a-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042275, "uuid": "5a6ca2a6-e1e2-4628-8c76-644718c96133", "comment": "Malware payload", "value": "491ac852b456fae2f1cc3a2b7ca6a119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042275, "uuid": "5435f9ce-98b7-49ee-b873-e4765b686056", "comment": "Malware payload", "value": "dd7b9d34c04e49362094e526ea408287e440a054ef1f58dc4f1f3ae1e100516f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042275, "uuid": "ca500aff-0df8-4e51-b8e6-15ab8c04b6e3", "comment": "Malware payload", "value": "853c725760c1acb8518905526a48c6f332b3f61f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042275, "uuid": "d807bbf2-40fa-4910-b709-5225b01493f1", "comment": "Malware payload", "value": "26a31cce19b3fd99683c2175ee738037e43dc170b2d7e58120cb66ed50eaf40442f474748f10d8c03be40b7174d4d57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042275, "uuid": "76682c8f-65f8-476d-ba0e-cbaf07bed377", "value": "T13B856D07F2A191EDC09EC1B48346AA33BA36B8890621B9BF17D15B703E66F554F1E70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042275, "uuid": "a1ac39d0-d264-41be-acdf-36f6446a56dc", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042275, "uuid": "49a978da-0839-41d0-8a24-8b0dca561617", "value": "24576:pg4hnCC6v4vk8yY0cCGSyAABTwx+tAmQs/YMTcfC8xB/J:pg4hnCC6gtCGSyAAd1us/YMTcfC8xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042275, "uuid": "3f07053d-6609-4694-bd4c-b15319b3de29", "value": 1711104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042275, "uuid": "ece87e3f-7ca9-497c-bd2d-15e60f6568c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042275, "uuid": "def99027-6767-483b-a06d-a967f177bf87", "value": "test_gui_enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac04c40-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765049652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049652, "uuid": "0da5f71b-8172-4ed0-92d0-82456baebe26", "comment": "Malware payload", "value": "95708346947f327875588b636ba86434", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049652, "uuid": "bdb7c8ae-e32b-48e8-ae67-b7a5aa595011", "comment": "Malware payload", "value": "ddaa7d52f83162d92cd68424d669ab962c1096154fad030f02d0431e1201a029", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049652, "uuid": "282a9671-19be-4a9f-a566-7a491edd04a5", "comment": "Malware payload", "value": "3fba2a73e0427e170e37a1a95577d178bbd94c24", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049652, "uuid": "e28206f8-be73-4be3-971a-dc0e2bac001b", "comment": "Malware payload", "value": "0ddfe85f16c3ed1cc5be0016181de8b768705b8d5eee86471d3ea4ac055d47de6d677bdb96e68603b331fddbc8d1e5f1", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049652, "uuid": "911acba0-aa5f-465e-9728-319086c4a6d4", "value": "T1DBD34A0B77A530F8E1778635C9A25901E776B83507A18B9F0BA047A61F236D1ED3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049652, "uuid": "8e920e76-ec3f-476b-8fca-f38334744bbb", "value": "9b68d8a1595e9e584e5c6334d7de3252", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049652, "uuid": "2348a0c7-25cf-4a2d-b45a-28e13b17f30b", "value": "1536:29vOr8UDLH38xfntCm/4+1Wvz2BWlXiW7VBvzmErGTmWSedOKk0EUMEoECV5CsWa:6Or8CHXmQGusWhHV9zmYqTC/JwPmAm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049652, "uuid": "44c8c4ac-6646-4d68-b59f-ebe2942abcd6", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049652, "uuid": "37fca902-3903-46d8-a42d-738173c88e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049652, "uuid": "8ead3acc-d7d4-42f7-9839-2619d13f8387", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a4243a-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050067, "uuid": "fdd56c4c-51ea-45d9-b3d7-b267acd410f1", "comment": "Malware payload (Mirai)", "value": "27b5cbd4697a84e08d55e71e4fb8a3c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050067, "uuid": "bca85171-f50d-4c30-bc85-535a5d69d475", "comment": "Malware payload (Mirai)", "value": "de357d58317b8f30990fd46e38290aa7f7f79e2719cefb05f18e9fe7eec3cf4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050067, "uuid": "9d9a3e7e-0e0c-4fa1-9c5a-f6490f68e4f4", "comment": "Malware payload (Mirai)", "value": "3b2e1db58efd607121b26c74b3eb9c915df5227c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050067, "uuid": "b1325d76-7e30-4130-9142-bdda5cc8ed39", "comment": "Malware payload (Mirai)", "value": "baa0a2010cc217abab4013710562f1dc047cb5df60a41b75893b39d8c9e1632993b579edfa5ad2a8fdc6ebd8ebdfba05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050067, "uuid": "b4985b39-5f12-496c-8eab-5d42fbfe883a", "value": "T1D403F19345A34E5EED3E12784846A907216143C2C58994BEFBECD0FFBC41697B71A286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050067, "uuid": "8a2d67b4-c663-4e8a-80f9-92ff42829e74", "value": "768:zWEpd2cR0FVepN18qzdmtRPwZVpX38YFYjeStn+FTBXXyvMH4LYEZdtjelcuPywu:zXjnGMN18EUtKX38/jymvMH4LYMtjWcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050067, "uuid": "19c38d41-ec1d-4a78-b4cd-02392c59d4f9", "value": 39332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050067, "uuid": "3137c177-10f8-4e99-b96f-0e62516cf735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050067, "uuid": "6b6ae5d1-cff1-4777-9b9c-c6f1d301f092", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa1061f-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033903, "uuid": "4a866f12-b9c5-4847-9d12-51a422dbd363", "comment": "Malware payload (Mirai)", "value": "dee330eef6a020ce1acfe8649ba79a0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033903, "uuid": "b36cc9db-ac44-431f-b0c3-895345776bd9", "comment": "Malware payload (Mirai)", "value": "ded0bc262426352e6d8430dfae2c6828959d9e0c921e8254487e9f319dacdabb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033903, "uuid": "fa0821ce-433a-4600-9a3c-fb1374c71884", "comment": "Malware payload (Mirai)", "value": "4366e531930627138bac4583dc0b56a53b9592bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033903, "uuid": "a5c527d7-c0db-47cc-bcd0-b923a2ae1879", "comment": "Malware payload (Mirai)", "value": "858969132d2f048c5bd6cc9df0861df7174b896187f2676d950333d2b623e793a970a428857d297b883c6c4192d71abc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033903, "uuid": "72060947-1e79-45fa-9cba-c5afa9a49588", "value": "T18D331982B9818D16CFC0137ABA6E13CD372127ECE1EE73079D216F2836DA91B097B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033903, "uuid": "16e9076a-7d87-44ca-a8e7-fd62d973716a", "value": "1536:4JC99wkrPYGtZo4i6E7HrbH+A59mr+14X2i:4JCbmN/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033903, "uuid": "c6432e13-83a8-4f07-9f69-ba497ebd25e8", "value": 50216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033903, "uuid": "fdc8ea4d-1a14-442b-85e9-8f9488f0d0fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033903, "uuid": "69e5c9a4-29d9-4b19-bd69-2ff9e82a4d56", "value": "b3astmode.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77511832-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049190, "uuid": "6f3a32f2-0861-46c7-88f7-827a3bf54452", "comment": "Malware payload (Mirai)", "value": "fe25cf2763df9347b2f49fc027a4ce1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049190, "uuid": "5a3d4038-ca7b-490d-bfa0-73bd5ae843fb", "comment": "Malware payload (Mirai)", "value": "ded5f58c22030487d88c76a96bb35ab4aecb2ff63b41c3e0ff48e7cba1cbe4ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049190, "uuid": "f65ab8a3-cc66-4b6f-897e-b36819210214", "comment": "Malware payload (Mirai)", "value": "a24f86d4b22374734d144428d94813c5298433c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049190, "uuid": "1012d51e-d86a-4231-9067-02fbe27b01d0", "comment": "Malware payload (Mirai)", "value": "4a43e5aa881f50fc2046531e6b95bd06e9657c13f3bdfe69b2c650733484e40de09af569e35888868b56282347cf4ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049190, "uuid": "3b4621d3-3efa-40da-b868-44250f76b9e5", "value": "T11FF47D2BA1B3F1BCD117C03047DBCAB25532B47916316E7B16C4DA393EAACE02369B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049190, "uuid": "1f132b4a-9752-46b7-ae82-2beb059d222e", "value": "12288:mmma4y4jxsNg669alRdCHFr8pfppWbvt2MrgayU25bVHX:XbJGxsNg66m3Wbvt2Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049190, "uuid": "c15caabd-8edd-426e-8606-b7dd34d9bb9b", "value": 767928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049190, "uuid": "37c1ccae-a272-4f25-b7c2-723136c30cd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049190, "uuid": "d0eca4b0-4051-4fe4-9610-6eab62036089", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160ff61f-d2d5-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765047308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047308, "uuid": "f1bbf2c9-db5e-459a-b6eb-a25333f49c82", "comment": "Malware payload (XWorm)", "value": "15a6a8bae76ea26ea8909e1e0f24f2a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047308, "uuid": "825e82a1-37c5-432f-966e-e491ff46ee5b", "comment": "Malware payload (XWorm)", "value": "ded8ac26fe5cf263c473d957436a597d1eea50fc6ee8cf59aa54a90adca64074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047308, "uuid": "8547df7d-3070-4fe8-a905-bff7e671c77c", "comment": "Malware payload (XWorm)", "value": "521772dee23e1a0163f9a1e4b3286cdd953ff48c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047308, "uuid": "e55eb3cc-6b09-42f1-b9be-89eeb614d4fd", "comment": "Malware payload (XWorm)", "value": "908e0c263c76e600eefaafa7bbf12e5e74a1ae02ca5520264e5aaa1423c0501d92a6834f5565b3db09f58eba3d07ef14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047308, "uuid": "d0f6f2f0-4742-43b9-a262-677971ab37c3", "value": "T1E4E22B4877A44712DAFEAFF12DF261065270D51BD813EF9E0CE485EA2B67AC047407EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047308, "uuid": "0d87c101-9c3e-4e4b-9a9c-129ff432dad5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047308, "uuid": "b3a9fb88-3887-47a5-bbc6-820a49046b93", "value": "768:GRPD9OQhx/BV3Tw4dOdVFE9j7uOjhAb80:Gd9OW/V3U4dAFE9j7uOjWw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765047308, "uuid": "7bb41c63-c018-42f0-a12f-57c09ae0428e", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765047308, "uuid": "9cd412da-09ce-43d4-88c2-38d288034b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047308, "uuid": "2d3021c0-c7c4-4ad7-807f-30d87a0f84bd", "value": "15a6a8bae76ea26ea8909e1e0f24f2a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bfe9c9-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981627, "uuid": "85b63597-22b7-4745-9d44-5e96abccec19", "comment": "Malware payload (Mirai)", "value": "7829901666397fc13373e463fceb4d4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981627, "uuid": "a85ebcd7-7fe7-4329-ac1f-6be57f0818c1", "comment": "Malware payload (Mirai)", "value": "df2ac9adc5964c1af0a970fa475b8dd20b8b3ec3e6ccb773a2914ee468722f94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981627, "uuid": "ce0400ae-69ac-4b62-8c72-0d4501d19038", "comment": "Malware payload (Mirai)", "value": "350eb8c78caffdb2a54c763f035022981db3f569", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981627, "uuid": "f6e2e46b-5b18-4f00-9c98-3255fa1ab923", "comment": "Malware payload (Mirai)", "value": "0a2175fd273f8d0e0da4ef03c1a327c5654d87ea25a0571acef0a18139dbb43778860e5662403f43ef612b762796663e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981627, "uuid": "e0ecd88a-837f-43d4-a8c7-4d763d53410b", "value": "T18DA36DE6F400DD3DF44ADBBE40270609B930536527A30F3B96AAFDD37D321A85A16E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981627, "uuid": "36297754-7adc-4b47-abfa-0cdba9ae46c9", "value": "1536:ZPy7LdY74yecNk00AP72iePt8NQvBK/jGx9UZMDX/6KswnxC8U:ZW24fcmzcSiePhzxua7XxnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981627, "uuid": "223f1329-fcb0-413b-9ba4-89937b20fa18", "value": 102012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981627, "uuid": "4417026c-ba56-479b-afca-8fe1ef150e1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981627, "uuid": "55405f35-dde6-498c-89e5-b624b9e5caf1", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c148dca-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050056, "uuid": "5d89e723-17b5-4a7b-b199-11c676b7e2a9", "comment": "Malware payload (Mirai)", "value": "094d86ec3e8d502b69fbded2ff3b9f2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050056, "uuid": "da432286-caa1-407f-bec7-5e6b10109a17", "comment": "Malware payload (Mirai)", "value": "df6d0caa58dad9d7ab9c9403f50ecd81d2bc3c58793b442cd02edcbbaa301479", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050056, "uuid": "0cb0999d-271b-4003-86bc-041a20a284c0", "comment": "Malware payload (Mirai)", "value": "bc76601b50c779d367ab30c5dde72b0121d70606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050056, "uuid": "86d411df-dc7c-4082-bb97-51fb1292f5e0", "comment": "Malware payload (Mirai)", "value": "c8f593f79fe9c9804dbcb54d67b05397d9066f4e4ce0fb24467892f959b430d3aab5565b19cafdc8e1153d3968e0a627", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050056, "uuid": "c68b6c3f-6cf8-4184-854c-df3de9682004", "value": "T10E03E160B1C65926D9E3B0B205DFE04B182C5219ABD87E574CC0263BBE97FD975BC2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050056, "uuid": "fd337f14-9793-429a-96cc-a4216bea895b", "value": "768:9uvVSVa/0oCgUJzMAhSkwBH2I1B8t8rUr1OHfjPfxH/AVEwtgEqiCffqivVnbcuo:EvVSoMoCgGzMrB8irUx6BUgE/C9Vnouo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050056, "uuid": "065d6998-7b9b-498c-8a56-82700ae656f5", "value": 40608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050056, "uuid": "3ecb3724-56da-4fc4-8bc3-1837abd156ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050056, "uuid": "36356faa-a035-4b50-8f2c-91a77b62b880", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b186469d-d282-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765011921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011921, "uuid": "0b416362-6221-4272-9a46-549bc0d89f57", "comment": "Malware payload (Mirai)", "value": "04b5bd1f5f14a4c32fe383941513e6d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011921, "uuid": "8f1a2cf4-98e6-4ffe-ab3f-2296162c5a03", "comment": "Malware payload (Mirai)", "value": "df84c8850a5e1f707391202f39c5b34346fd585cc5f92517555f8d9d25f39bb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011921, "uuid": "6d1751fa-00f2-42b2-ad3d-e08bb9b51b29", "comment": "Malware payload (Mirai)", "value": "464f0b66df4c08fd46bd612848f71f894b513002", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765011921, "uuid": "47dd7f83-f318-4b66-bc08-77a1afed746f", "comment": "Malware payload (Mirai)", "value": "06e9705de6e55288133ce08000bec512bdc842b38d67dbb9e056d8a0f450603507a4c900a443a23235e23355424496c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011921, "uuid": "d6f5aa2f-053b-4b60-ae71-cd1174453311", "value": "T16DB32946EB418B13C0D51779BAEF42453323EB5493DB73069918AFB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011921, "uuid": "9177f714-db97-4973-b6e7-b6e33e72a281", "value": "3072:SJjla6fu0bOzRP4+rNW1JP00kUuHyU+M/9t:0jla6fuPrNW1J80aHynM/9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765011921, "uuid": "a24e4b3b-1420-4f82-a302-16d5527265ee", "value": 114654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765011921, "uuid": "92870dd5-e297-4c88-a49f-01c21cba1f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765011921, "uuid": "a31d3025-14d6-4280-bb4c-31d5e2886ece", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2314a3e-d2bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765036887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765036887, "uuid": "667444cc-fdb2-4e0b-ba9e-50af1ed97394", "comment": "Malware payload", "value": "93692a2c0ce36d405a7ca0a79af9ee67", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765036887, "uuid": "4facc23e-2a3a-4717-9cde-8fbfbf5ffc9c", "comment": "Malware payload", "value": "df89e7b1db6e8483bb52d652b7935ed02d9b1b4258a33680ed1af96b00e7b281", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765036887, "uuid": "c88e8d92-957c-49b3-8fe7-c1ea2b549c71", "comment": "Malware payload", "value": "0965ccb6927624ade647983d06e60f0ded67a671", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765036887, "uuid": "18d947b5-f625-45b4-a849-3115364835f7", "comment": "Malware payload", "value": "006f3a2b642252e8ffa3bdbee4e2fc44c1c65335fd844c8107787f893188f72e1b62b7dd48ce51c5e62468523036b361", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765036887, "uuid": "d2613d8c-be79-42f8-9e14-ec4e2362ff6c", "value": "T1AE849C16F39404F9E8A7827C89524503EA73BC160760E7CF13A46A5A3F237E45E3E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765036887, "uuid": "72f3dd4c-b7dc-4d0e-938e-d748497ae6ed", "value": "f83dd0fbb4cf3cdc82e09429abfde7dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765036887, "uuid": "4c974400-5076-411e-b5b7-8529a3e632d3", "value": "6144:/K2sofqWLYLyzEwHN6VdVQ5v6FlfcORPPXDsBRHJeqF:dRfqWLJH8dVQ5v6zPPzwHJe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765036887, "uuid": "985ced29-ac29-441f-9860-443286f030e3", "value": 389760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765036887, "uuid": "cf42d167-8308-4b0f-900d-c628d1fc7114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765036887, "uuid": "1db93669-9029-48de-b00e-c0761eb1f674", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e278a1-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006363, "uuid": "477041ec-b14d-4ec7-8a7d-953cdd5cf0d0", "comment": "Malware payload (Mirai)", "value": "5d799bc1e9042ecb674e5000268886a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006363, "uuid": "8a9b6b2f-0fdc-4426-8fba-a27fe297e740", "comment": "Malware payload (Mirai)", "value": "e1db43ab002f22a3fb6727c0451f190e7f4622bc1113da97a9608686e4708cdf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006363, "uuid": "9ca703b4-79f7-40df-ba91-2bc9e5ad1cb2", "comment": "Malware payload (Mirai)", "value": "28064b3ee00b572e5631bb7d25425bd88bd9c0e4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006363, "uuid": "791d5a2d-111d-4f28-ae7e-1bb927677240", "comment": "Malware payload (Mirai)", "value": "07bdf9c4b02b039da70752028e2e3a48e6e547290a8fbe1769feb6037278751c047b21259dcc075b6abfc707c8d39c77", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006363, "uuid": "a09beadb-3527-4290-a040-e7bfd3af2636", "value": "T185E0D8CDB4630073285DCF1BE0A4454DE451F89559D03E94589F3C19383EC1270F5637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006363, "uuid": "c76ec301-bd9a-4159-b466-a1f4b1b52727", "value": "6:h9OnFflE0FJByQ7BodAjJdyzHGdyzNdyua/iKHEIDEivpv:d0FJJydAjJdyzmdyzNdyua/5hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006363, "uuid": "9feba5fc-9882-44e3-8191-53a2bca652cc", "value": 361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006363, "uuid": "1a2e3d31-d6ff-4172-950d-8a5dc873debf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006363, "uuid": "4f120cd0-a055-49b1-9667-b040e978ee2b", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2e3128-d2dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050303, "uuid": "fab63738-6b23-4c85-ab52-6e87cf1c9f9d", "comment": "Malware payload (Mirai)", "value": "5b41cb90328082dda7e726ca5821472f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050303, "uuid": "9c170831-014e-41ce-8f8d-3997ea6a21f0", "comment": "Malware payload (Mirai)", "value": "e22c1674efc72871e815a17a51e9226fe1b07cc23f730b65b707999149a64878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050303, "uuid": "ea8b1f5d-e53b-43fd-8d78-23801a186a5a", "comment": "Malware payload (Mirai)", "value": "8d2517ae2c2196639e2bc4978675f5c75781b423", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050303, "uuid": "94bd310d-20a1-401a-908d-eadeacd27923", "comment": "Malware payload (Mirai)", "value": "af1d0299918c6d8a506f4abb2bebd0c7aa695f633f5e9de1d1b3481db8f4640fe423dd4645cf3b3216aa4317ab7e53be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050303, "uuid": "60e1a154-979b-414a-8854-2a2434b327eb", "value": "T1A7B2D02868169626DA7198BFDAB4C79B5A8783B8C6F6300B2514921FB2CCD4237F5583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050303, "uuid": "f3e71782-f546-44fe-9927-79811e349dc5", "value": "384:j+N4Fg1pprVDaHczsfOKVZoevYNzhRZSK53004HyBCln6g8ZhymdGUop5hLI0:HFSWGaN2xhjSK53ZZBCMRZs3UozX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050303, "uuid": "c894245a-dd3a-406c-880b-a832e513c1c5", "value": 23972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050303, "uuid": "30d58af8-d784-49b0-8298-c27ffca89c18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050303, "uuid": "e29a375d-7ca3-4381-b603-03546d4369ca", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3591ae2f-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042207, "uuid": "e949058d-006e-480d-a9bd-437cf62870a3", "comment": "Malware payload (RustyStealer)", "value": "e2cbe3bc77b1ce11192fd0d542d6123a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042207, "uuid": "866b69b5-6830-4e17-bb30-928a8b37696c", "comment": "Malware payload (RustyStealer)", "value": "e25e19888d615b9fb15da4cd7c4cd34dfa53250becff3d621c59c9fa38efdcf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042207, "uuid": "26bfe099-9a3c-4b4f-9c07-6a28c5f4ff02", "comment": "Malware payload (RustyStealer)", "value": "c2d6e40976b237b8f0a034d30df9e60a7771c416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042207, "uuid": "6d04bc88-8e8e-4f6c-bbe6-53891eabc874", "comment": "Malware payload (RustyStealer)", "value": "794ab675af135d5380fecfa288da5a3e4648a6237930f342458d3df8c7695d6f90691734df5e7087242ff3c23034b8d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042207, "uuid": "e794e068-e35a-49d4-9626-96971e9b0d1c", "value": "T127858F07F2A581EDC09EC1B48347AA37BA76B4890620B9BF17D55B703E69F514F1EB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042207, "uuid": "bad0be9d-9047-4a3b-abc9-846e872ed2b5", "value": "a0d042903cdca7ad69043e384147e80a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042207, "uuid": "690f3c1f-56de-4e1f-b413-f50175f06c9b", "value": "49152:YNW8bDCVMOC0p/GSyEaOKBFXyvgFT8PGV5:EOC0p/GSy9ygEGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042207, "uuid": "71b4168a-b43a-47a9-880d-24ca78688939", "value": 1717248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042207, "uuid": "f3315b65-4296-4f54-a4e6-347ae52bc16e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042207, "uuid": "a173ae17-2c62-41e7-b2b9-b9d1f8940049", "value": "enc_pervictim.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb1ce16-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042223, "uuid": "2569f0ee-d320-41bf-a30a-18e86f3e08d6", "comment": "Malware payload", "value": "6926ea1b4c4bff01a23b7e1728583348", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042223, "uuid": "f0a772bc-7100-4aae-bfa2-6da702d7aca7", "comment": "Malware payload", "value": "e26e9221f4e9a437716a28c08c5f74c6a2ecae2c47b77091db7d21f36ed2f7d3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042223, "uuid": "83d8c631-e6e6-4712-a17f-04e0d054aa38", "comment": "Malware payload", "value": "81c2cea6e40cfbb52aceedaee626d4acf5f2744c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042223, "uuid": "8f895f8e-cfbe-473a-b052-41f2530c8aa9", "comment": "Malware payload", "value": "fcfc08aa293589dbcaf6388931eb8b8b044160222c1b1011e6ca42c63571e18955005852f0da2d8a2c02236a46d3b231", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042223, "uuid": "70451f05-963f-4b2a-a685-14ac6b2ee052", "value": "T129A48D56F7A41668D05BC034C3579272AF71F8A92720ABBF03E092381E56FE25F2D719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042223, "uuid": "b06d34e7-57d7-4dbc-8dbb-9c067f97d295", "value": "54e71dd6ff09fd569a5edc86ee874acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042223, "uuid": "913d87cf-ee60-4d98-ad34-8f6f85504603", "value": "6144:Hdke3xh9mL8gjJV76hTlUU7uR+xcr4Vt6eY0hYcy5rFVfpmeegdgpSzGvrAA:HdkiZgjrwUecr4Vt6eicyxFVfprTKkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042223, "uuid": "c2e34194-68c7-4349-96f9-761000b12947", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042223, "uuid": "443a9187-60da-40b9-b067-0db08b852624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042223, "uuid": "a0591360-4734-4253-b4d5-237129f46ac4", "value": "killer_crowdstrike.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cac2ab5-d261-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764997525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764997525, "uuid": "365e869e-8def-4d45-b72a-0e5faa54e5c2", "comment": "Malware payload (Mirai)", "value": "070da8eedc0c2416b5a9efe8679faf18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764997525, "uuid": "256e64c8-58b8-443d-80ae-6884fe5d08e0", "comment": "Malware payload (Mirai)", "value": "e2a53bfcaedfc2415e2e4fcf9da66c42966981571c6f21566ee0e248a48bc02d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764997525, "uuid": "0aae73fd-24dc-49f4-8ae0-19c671a88bd1", "comment": "Malware payload (Mirai)", "value": "55ea66a28a3a91d165cdfef83fbe177ab31b2095", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764997525, "uuid": "9c8721e5-91ae-442b-9242-d6215de2c3b0", "comment": "Malware payload (Mirai)", "value": "c71d7a34dec764c81b4a5b4d51e85179bd5f9d5bcb9700933867cc286f471421abccb4063ef888ff2a62885e1043fc3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764997525, "uuid": "95d5814f-8d5f-451c-b29c-f6780052e9e4", "value": "T122A3DA5A7E224F6DF768C33457B74E30979833D22AE1C585F16CEB091E2424E981FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764997525, "uuid": "45bcc33d-3133-4304-b2b5-c9d08c5e2366", "value": "3072:T4gjxNFGyyHioFBv7h99OoFhBSaSLu9ZnW7R+:T4gjxP5uBjh99OoGic+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764997525, "uuid": "72cbbfca-1627-4fec-ac75-7698282c9f73", "value": 106088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764997525, "uuid": "37b5dc7f-208f-4184-8c01-640ec649dab3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764997525, "uuid": "a0bb3d96-6a10-47de-a328-5ff5b31c5159", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e86890-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033915, "uuid": "65cbefc7-7599-4694-b0d8-2d8bea0fbdc5", "comment": "Malware payload (Mirai)", "value": "24ded0ae7cef7f22f4e120fb1c4b7fbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033915, "uuid": "3a8049ad-24c6-4922-b15a-e45b8a7a2280", "comment": "Malware payload (Mirai)", "value": "e451fca4f10b962a8d276055bc847e001245b2a6cc96d1375eaa6e33ec37611f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033915, "uuid": "5f34ab4b-4a0a-4b82-9d0f-53972b75703c", "comment": "Malware payload (Mirai)", "value": "5c04fd7dc8c0e133357bf48ab0118ac6b22da590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033915, "uuid": "529bb030-b8b7-408c-bae7-08335ec99b65", "comment": "Malware payload (Mirai)", "value": "06f7189136df531d846d02a98a05a3162d993c656361c418ea1cae4f82a820b9ecddcdbb9325d2deb39acd4be5a8b8a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033915, "uuid": "e6b263e4-1626-4c68-a385-2c0448872cfe", "value": "T170233CC9D5C3E8F5EC15097520767F369AB3E67F22A8D947C7EC8432F801502E50AAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033915, "uuid": "01593bae-34a5-475c-a98f-189afcc683ef", "value": "768:oxYMnWMWM9b7xIxkXZLVU0FDCgT5ir0kRxe9Jq88qjH67YnnxJ5zPJie/:oqMnWxM9HxIYLVrZVir0kRxe9ClYnnx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033915, "uuid": "e23f4b5a-29bc-410e-8ce0-7cfe92d78f12", "value": 45936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033915, "uuid": "bdef5458-e04a-4b91-b853-8adc7ac05a57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033915, "uuid": "b104a3a3-74ad-4679-8e85-0f59c123e695", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73edc77f-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050043, "uuid": "0d59826e-2739-4636-baf0-10d58456d7bc", "comment": "Malware payload (Mirai)", "value": "864615b41ce4569c7631dd7c1e3e17c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050043, "uuid": "202dfb60-108b-4365-af3a-52e74c89ad24", "comment": "Malware payload (Mirai)", "value": "e46d64f35ac80e424b00a2d8cbdc9b32c9a039df69d1a2eb1659e94707c02a7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050043, "uuid": "0d9cdbdc-8492-4025-b7f1-34b57a446400", "comment": "Malware payload (Mirai)", "value": "ad45f961025b74fe97153c02e159001210ee853c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050043, "uuid": "baeb292e-4451-4100-ae06-3b735b4c9ae0", "comment": "Malware payload (Mirai)", "value": "ec71206497759208ab94e93db159140c5031ceb0a8cfd18e9825d91770734157acbc737ee4228a9456f7069446a39fdb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050043, "uuid": "ee381bdd-91f0-49da-91d6-45322aa636d4", "value": "T18BD120F2B48552BDDE9FCC3E5214296E2086E98B1A8B0D6887FD2465BC89FCD1C509D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050043, "uuid": "4c8b04db-3b5c-4ef7-bfa5-af8f567c62e3", "value": "192:6d3mBP6OBqWrp83lOC12iEk7s4AgnA8VPOZ3VPOZ3oofI0fNwDhSGpie0Ur8ozxU:6d3mBP6OBqWrp83lOC12iEk7s4AgnA8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050043, "uuid": "9fc6fc49-b4c3-4c71-a0ac-09e8259238c9", "value": 6389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050043, "uuid": "12b07c63-327e-446d-a666-bb9f480ccf8b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050043, "uuid": "d8f82747-1995-488e-a29d-841263e490e9", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf161a7-d26a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765001709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001709, "uuid": "c42519e9-c534-433c-8bac-dc591654acc6", "comment": "Malware payload (CoinMiner)", "value": "4c7c33f3c94eb1f64d90a549c379e0ce", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001709, "uuid": "71eb36f2-212b-42db-ab99-2f65834d10e8", "comment": "Malware payload (CoinMiner)", "value": "e4e170691634d841e8976ae918d2df223feb359db7f4b1c11a6669618bce648d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001709, "uuid": "f67f59f2-b293-44e8-bedd-07200d90f29e", "comment": "Malware payload (CoinMiner)", "value": "79e4ff489199690881a5178dcbce65ce0b5a83ec", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001709, "uuid": "e8b6e3f1-414e-41ca-8882-5c9da82c0646", "comment": "Malware payload (CoinMiner)", "value": "08879c4332a452997551d92c421e18c8e2e0f902ff670da74d4772b03462920a0fe158d9eacab6dcc2142f6e033dd0ae", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001709, "uuid": "642ef5d9-1662-4e70-9586-a65de45b2285", "value": "T1981154CAA061DC70389C40BCE2865051754A9FBB04D58854B80F367E3F54169F53C73B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001709, "uuid": "9a8a9cc4-3270-42ec-b6a4-9151f25f5d74", "value": "24:wdfGyZ1rFy/iKbpJnHOjWIEQXi/rvsTI0jpXnn:sGc1GH6ECltXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765001709, "uuid": "c8d7cb88-5bef-4d60-bf3c-8f258404ccab", "value": 1071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765001709, "uuid": "9ab5b136-bd7f-4e43-8f03-84c6b5583e57", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001709, "uuid": "7d66119e-a37f-4e51-a27f-c39448cea95e", "value": "bolts", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebade3ab-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765048955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048955, "uuid": "33eca47a-1ccf-4905-a370-99ffac12d05b", "comment": "Malware payload (Mirai)", "value": "2335e009994fb46fcf493559be504b7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048955, "uuid": "cf5adf5e-6ffe-438c-bada-adb4ecff76f9", "comment": "Malware payload (Mirai)", "value": "e5312511362dc1c7cd197ec556e40f5b7a584a6f334c613bf1b7144617880a60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048955, "uuid": "a5ea8f35-555e-4c40-9f6e-1500e8ccda20", "comment": "Malware payload (Mirai)", "value": "12db1bbf4f46e4f515f8702dd4a9c485239e19eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048955, "uuid": "cc7659b5-ca11-429c-8c73-f13fad519a2c", "comment": "Malware payload (Mirai)", "value": "56003570c4e8c698fdb34e444a643fad0502cea0faa014d2c9feb02ab8830056dce6d26061df75cba31ecf5cb779d69c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048955, "uuid": "ccc35f46-4be8-4d15-949e-222272446ef1", "value": "T1CE33D79178D15A2AC6E423BAF9AE408E3321B3E8D1DF7217CC241B047AD552F0DA7B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048955, "uuid": "15921b0b-d725-44ef-935f-55afe6de934a", "value": "1536:YGZh1mxMBEfiJo25+J+KEwrKdqnKKUWhK9RP:YGZ++tS+KEwwKPh6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048955, "uuid": "7cc2fc29-1877-47bf-b3c2-cf6fd9b37ff6", "value": 51172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048955, "uuid": "45d75b47-7dc7-466b-8ec3-49557b3ec825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048955, "uuid": "dff11914-71cd-4530-a8f4-ae9a46b382a2", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c955cf-d2bc-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765036752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765036752, "uuid": "4bf9fa6d-f64d-49ce-9912-65d29f98f449", "comment": "Malware payload (RemcosRAT)", "value": "79522f00dff3d7ae78cb529a88c96ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765036752, "uuid": "f7673e9b-8aad-4e1a-8d90-4b560d9344d0", "comment": "Malware payload (RemcosRAT)", "value": "e5b66e6b3ca7c0e7deb93fc53b46b523862cedc7360a4d9660d9f61c5cc19ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765036752, "uuid": "bf116d59-88a4-4b6f-a69d-78986c8225cb", "comment": "Malware payload (RemcosRAT)", "value": "3cc0fdffdbe9bdbd84bf71ee216ef6766750e85e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765036752, "uuid": "0e6af5e2-f917-49a4-9d19-c6b9abc528ca", "comment": "Malware payload (RemcosRAT)", "value": "6f188ddcbfc79adfc0a419762725ed2ba167caf8c7a1c1aa3d794c3a06b6f67d42d330914f972fd3617c292a3be90a9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765036752, "uuid": "3d115125-13cf-4c9c-9db3-e306788b98e5", "value": "T10BB4AE01B6D2C1B2D57654300D26E775DEBCBD2028369A7BB3DA0D57F970180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765036752, "uuid": "8a883728-62a6-4cb3-80e6-96db39d73889", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765036752, "uuid": "60db50a8-43e2-46b0-bf26-11334682d5f5", "value": "12288:a6pxxGI8gvGOHJpAbDYGxLhZ+sPZtxmPFN:a6pxxx8U+bDYGxLhZtZmPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765036752, "uuid": "7c3cae18-8fbd-4f9c-b857-7208cce01d8f", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765036752, "uuid": "203d7e9b-f4c0-49bc-b225-208b83d6146d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765036752, "uuid": "71d10db7-0d3c-4761-9c73-8f3b62a3bf43", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dddab47-d295-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1765020022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020022, "uuid": "b410c510-183e-4855-9307-a6b7d4864282", "comment": "Malware payload (a310Logger)", "value": "f6c0b482c3c61351ec252ad3ff768192", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020022, "uuid": "1a0e859d-1a0c-4f46-b235-e87b151ebfd3", "comment": "Malware payload (a310Logger)", "value": "e5da91f0f846bdeac343634ffc4d68ba9250f552dcd5c3bdffce6daddd6dd10a", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020022, "uuid": "bda26368-14c9-46b4-89c1-1f01df240c83", "comment": "Malware payload (a310Logger)", "value": "e6fbe0d62610411545ddc635286f6ffb4451b3f4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765020022, "uuid": "b0129c96-29e1-449e-8a11-9141f2c8536d", "comment": "Malware payload (a310Logger)", "value": "b3a6e645c09fcc726947ff94369c30f87cc7a29f7c1b7d170fcff943b11ffbd09ebe666db0f5340cee7e239751de1e52", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020022, "uuid": "c2900f4e-dead-439a-b4bf-b0665135597f", "value": "T17455BF0273C1C062FFAB96734B56F6115BBC79260123AA1F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020022, "uuid": "bef565e0-a354-4812-844d-742c42accc85", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020022, "uuid": "e8680139-976a-422f-8d4c-4cd3ed6166b0", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXda6Rq20X/TGb4a:vPVt/LZeJbInQRa6Rq20r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765020022, "uuid": "a624534b-af77-4e58-bac6-5edc973a5580", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765020022, "uuid": "d8387ba6-fa56-4eda-93d3-02314ff8a019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765020022, "uuid": "38be392c-3542-4d1b-9150-7715ab9823e6", "value": "PO_3429010000046093122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2827101c-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765042185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042185, "uuid": "684884a7-cfa2-45c6-a726-cc706a402c6c", "comment": "Malware payload (RustyStealer)", "value": "73686eb096b011f3c005495c3a6a156f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042185, "uuid": "9b182ba5-90e2-4600-b66a-dab17ea7e51a", "comment": "Malware payload (RustyStealer)", "value": "e618c6b7bc2af212f54ed865c84577d2232e50be200925ea8455bd23d549bbe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042185, "uuid": "d8bd92ef-a104-48aa-897a-e50a4adc3b68", "comment": "Malware payload (RustyStealer)", "value": "d1efae3d7894df7b2573e96b67e162882496abbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042185, "uuid": "0daeb5f1-5b2f-4d2a-a42a-9ef5f50b23df", "comment": "Malware payload (RustyStealer)", "value": "1ff46fc166971bba8cf8dc8e95c67412b8105f2249c21f92e9ba15af77fb6b22c92379d74b0535402ec03a17a305c531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042185, "uuid": "b5cbdc3b-ac4a-4313-9015-4f1e93707e24", "value": "T1BE159E1BF695A2BDD55AC0B493068A72B536B4CA0621BDBF01E1D7343F96E620F1CB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042185, "uuid": "97266e44-1335-416f-99bd-12857f4f1576", "value": "87f0863ec927249773659ca301d7b700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042185, "uuid": "ba2763a3-39b2-426a-892d-618009ce10ad", "value": "24576:vH/Ls1S7APHLeQWzxfybcolpt6vSEo86M/DS9:vH/Ls1EcfWzxqbcoLt6K86Mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042185, "uuid": "3039845b-e4c4-418c-a81a-807f603b7037", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042185, "uuid": "210a6340-d6b5-4343-ab7c-0e675782da71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042185, "uuid": "91b79ba5-514a-40aa-a0ca-cb03c7a26408", "value": "dec_unique_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e446f9-d29c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765023194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023194, "uuid": "0e59d993-e2d4-4b7d-a16e-d66f47d8f151", "comment": "Malware payload", "value": "8fb325ab68925ad8aae6abcf6e95a7e9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023194, "uuid": "c27f36cb-f29a-4663-86d1-8d02fffcab38", "comment": "Malware payload", "value": "e6ad37a3d82f21cf079b7c1a543382f2711f8fa936d240a80b75c1a94b38e5ab", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023194, "uuid": "5f943065-1438-401e-949e-bc1bd3010e11", "comment": "Malware payload", "value": "5df9004b31808ac7c811127d024098d54cf7d000", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765023194, "uuid": "4bc83eaf-a0e0-4cfe-8809-d0f2c1070885", "comment": "Malware payload", "value": "c6767972466f584cb45d4a9b13ec8420532d00b1e00c1eadab07458f744430f253fa271b7c45962039d8d6762e092b9c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023194, "uuid": "7e363356-80ee-4e33-a743-5f512d05c8bd", "value": "T1B61533C3837898A3D9071AA4A111C660A23DC6CD819DFFD7B75D83B3444A91DFAAB52C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023194, "uuid": "5c7a3ba4-96fe-44f2-9684-9e0fbc3d1950", "value": "24576:0ow6N8lAZuZWJQmj7Yi2vNG96WUJ/bRqlSkFCHjRG:Zw6NiItjUiAj1bRqpFqdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765023194, "uuid": "218a081a-2487-40bf-a240-4ced8d51f106", "value": 938893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765023194, "uuid": "e39ca637-dd84-4623-ae79-eea5263474f4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765023194, "uuid": "fbb98274-7ae6-438e-9e01-ba010671f258", "value": "DHL Original Shipping Documents.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7d63d1-d23c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764981638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981638, "uuid": "7470f56e-ac97-430f-949b-24f4ce4f45be", "comment": "Malware payload (Mirai)", "value": "383b8621c3f35bf5d0d3cf354e274e5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981638, "uuid": "9a061af6-386a-4981-a353-7fc7ac7d4101", "comment": "Malware payload (Mirai)", "value": "e6bc0f584badd6a97e179fd2e91ef788bf4db69ea21d75127879bce269aa72ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981638, "uuid": "71f80782-c104-4f57-8040-570b03eaf123", "comment": "Malware payload (Mirai)", "value": "78bdb55c9e94fe23a1fc4a8b62adf0c5fde7d06c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764981638, "uuid": "ffdeb2d8-0ff8-402b-a1d4-381be6015e09", "comment": "Malware payload (Mirai)", "value": "fb85de0711ff0b2567d3f4516af1420103aaec8ed28ffde9d40f809550f304c02cd8cdffc477293f80d399b51a1750f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981638, "uuid": "e504eaaa-25fd-428e-bff9-b0f6054364e1", "value": "T11FD3F646BF210FF7EC5FCD370AEA1705248C991A22A97B35B530C828F69B25B15E3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981638, "uuid": "9098e182-1eb5-4842-8f7d-73c0eb537b5f", "value": "1536:QyNqViP5Y6IeeremuWpc3D9qsinjbOrWJl7xy6GVjZ67MtmSNAto:QydY66remuWpcz9TijgD6Cjz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764981638, "uuid": "c1d85698-207e-4ace-8028-c8969d16dfaa", "value": 130240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764981638, "uuid": "713136ce-67fa-4474-9887-b44bdc111cc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764981638, "uuid": "e923a399-1378-474a-a17a-953bce96e2be", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2105435b-d28e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765016832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016832, "uuid": "b2ba4811-badf-4b12-93a4-cc62f8d5df4a", "comment": "Malware payload (Mirai)", "value": "7e7f5700186a71f927f0e89a06fd9015", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016832, "uuid": "5b99f77c-1256-4db5-b189-405fef2e021d", "comment": "Malware payload (Mirai)", "value": "e6e53a4fdba4d1e01fff4c9ef401cae7264d7f0bd0a6e771fcaa4165ef363bdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016832, "uuid": "7a5a6403-08cb-4111-b2c6-5fdb24af8240", "comment": "Malware payload (Mirai)", "value": "21099bbb33d9cced72f29d07542abac901f7afda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765016832, "uuid": "850b7989-baa2-4d14-8705-24df7249ea92", "comment": "Malware payload (Mirai)", "value": "fced0eeb1a4c6153b7be9371081f31df4fcbc7412f22146c32b3baca2c63eab1cbc2f72dc9c6b82f96a8e855a8270a2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016832, "uuid": "cc2bc60c-cf8f-4899-9ef1-89923f18635a", "value": "T17223F204A36BAE108ABC1CBDED75439574671AECC098340EBA552FB8BC879C767347C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016832, "uuid": "55d14028-9d5d-4f0f-abbb-1250a546c566", "value": "768:eQW35sOj7YYMZeEjkQHplm7nqZTK8+yJdqAcQ4d5fKRr+kYV/ocEW9q3UELQu:eQWpAVIQbuiK8+AdeDiRlYVOLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765016832, "uuid": "0bb9c70f-1caf-46d6-b76f-aebf3b3beeb3", "value": 49616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765016832, "uuid": "44872b85-92f7-4347-bd32-1457edb68b15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765016832, "uuid": "d7a05d4b-f2d0-44dc-b460-7f6f7d0d4bc0", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530cace4-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042257, "uuid": "f7cbe76d-e674-4223-b320-a05c4f8d83a2", "comment": "Malware payload", "value": "674795d4d4ec09372904704633ea0d86", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042257, "uuid": "eee7bfd0-69b5-46d2-8025-c032dae6c09f", "comment": "Malware payload", "value": "e71240f26af1052172b5864cdddb78fcb990d7a96d53b7d22d19f5dfccdf9012", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042257, "uuid": "df7a333c-9a9e-4d97-9b89-732230a65167", "comment": "Malware payload", "value": "483feeb4e391ae64a7d54637ea71d43a17d83c71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042257, "uuid": "d95178ca-d5ca-4e64-ba00-f04bf7109cc9", "comment": "Malware payload", "value": "e248e9f5eb17b2e5ed94acb01ffaee3dff200fc2e51a7e11173362127dca6e54f43fc7b57284dc03eb733ca82c7a7408", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042257, "uuid": "87850e8d-f248-46ba-aa6c-abc28c45bbfa", "value": "T112946C16B6605568D15BC07493079772AB72F8992720BBBF03E4A2342F46FE61F6CB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042257, "uuid": "4d816e1a-a185-41e1-bbd4-300627b83dee", "value": "88b9fb23c42ac7046c29120107183855", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042257, "uuid": "5dbb498a-81c3-4893-98be-181c97605ebc", "value": "6144:eGx+3TC1L+PwGWF9nR+x2ciemSAxgasov55AmXgdgplB:eGxqu42cKJxxstmIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042257, "uuid": "39be382f-76bf-4d60-87a8-c79ab66385da", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042257, "uuid": "c46756b7-2e5a-4600-93a8-27eee308fbe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042257, "uuid": "224c8104-6621-47e0-81ec-e2a3f36fdbb9", "value": "rootkit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8b3ca4-d272-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765004858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765004858, "uuid": "9c123728-078f-417a-bc81-29ca09e9823d", "comment": "Malware payload", "value": "54cc11b73eba96df2408b606779a905c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765004858, "uuid": "b44a36f4-27e7-415a-9633-355de0c68edb", "comment": "Malware payload", "value": "e7de9b710a757a0f9ca72ece88a21db1a2dbda393734496b643267ac6cf8880f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765004858, "uuid": "3093836e-bfda-4c1c-8a86-6a63830625c0", "comment": "Malware payload", "value": "ef9339c9b752648aa7603d405a0cc8c02a1ad001", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765004858, "uuid": "adf44db1-d76a-4ba3-ad75-dcd2e928a00b", "comment": "Malware payload", "value": "6a3b905feb66d7857f9b3b1cd3d2484e78fd9328515dfacfabad418a34763df0c13cd74c513700cd85bf3f0f03b676c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765004858, "uuid": "c1789f24-df8c-4fcb-b04a-247815d24ab2", "value": "T1F83633ABE47E47F6CADD44241AB930B19F1A74A1F86C9E2E164CC097B9F19F0F254234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765004858, "uuid": "819f5daf-a0f6-4424-a653-58a2397ede7b", "value": "98304:d+sDmgikpssSmknTagbfEA6HPUCEzzOCssEQIK:d1DmpleASazzOUdIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765004858, "uuid": "882387a8-717f-4475-966f-600606dcfbf7", "value": 4972188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765004858, "uuid": "f83fc707-7a5b-4584-95d4-b6d27c18ad33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765004858, "uuid": "2b89be82-f545-46cf-95f6-08a74fd1cf68", "value": "INFECTED_node10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2f040d-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003379, "uuid": "d617828f-82c3-4aa4-950d-9315b5743cda", "comment": "Malware payload (Mirai)", "value": "3b084991f00e2d80416b32ba2d59449c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003379, "uuid": "d659d780-3b52-4131-b63d-56bc3627fd3e", "comment": "Malware payload (Mirai)", "value": "e89e4bd37e5fd8bae14fd881f670c3d6ae48c89cacc580e147fdeaa587753cc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003379, "uuid": "a23c6fe5-182d-4c22-876c-fcc605a64856", "comment": "Malware payload (Mirai)", "value": "95e570997c85d1a33696e029398617e6a0e14fd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003379, "uuid": "61448ab0-9976-48bb-9d83-369bf2391112", "comment": "Malware payload (Mirai)", "value": "001ca50af0fdc9075f7a5c811f5ad1f1784c2a55a1d3cf352de4831ba8f47669d9130620277f964f7d1f5e6f53387108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003379, "uuid": "d018279e-289e-4eed-8415-ebc3fc47e13f", "value": "T1D3E329DBF800DDFAF80AE33748530906B630B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003379, "uuid": "b7e11445-d61a-47f7-ae28-02e9e7c08fe6", "value": "3072:jRsZqZhrvKbbWOftDA4EslibVrjbiJLnN+eAyaih7a:ts1nfhAUliwLnNMyao7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003379, "uuid": "99b12f3a-2a0a-4560-95ca-be5d2aadef69", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003379, "uuid": "b4392b8f-9ae3-4bbd-8a32-c758eee24b0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003379, "uuid": "6b090874-3bb6-45c8-8fa9-65167ce9729d", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848ac21a-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050071, "uuid": "35c2a861-39ec-42c6-97e3-d6c9843588d3", "comment": "Malware payload (Mirai)", "value": "22c3bfa29febe6feb693913be304b601", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050071, "uuid": "b4710d79-9f86-4ddd-b18e-920592ae3cb7", "comment": "Malware payload (Mirai)", "value": "e8a8d907e3c38128194d54d7922759f2eb066cb7ad8a74f518ee978c64d185d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050071, "uuid": "c83e3759-8126-40ca-83c6-a663027cb593", "comment": "Malware payload (Mirai)", "value": "6784b7fcd5a3256a357efcfebddb07ba9ed41625", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050071, "uuid": "c1d0fc1b-5067-4c9c-a88a-331650539eb9", "comment": "Malware payload (Mirai)", "value": "fc1b4b6610b0f1d1a1731a0b8959c92413b0ed53120ca7bb621cdec88ffc116ffdf8b4ca7cea04db9884a9e388ccc6c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050071, "uuid": "fe027ef3-928f-49b6-8057-1747c29c598f", "value": "T157D124F2B4C5527CDD5FC83E915069BD1189B58B2A5B4DA88BAD30A57C8AFDC2C40DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050071, "uuid": "f862b560-0c09-4a66-9f85-68d47f354b10", "value": "192:7e3mB87OBqvwp83mnC12DJk7sV9gnABWPOZkWPOZkFofI5MNwDKzGpi35Ur8FYxQ:7e3mB87OBqvwp83mnC12DJk7sV9gnABy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050071, "uuid": "3ad822a0-004d-415d-bbbe-f123ee919f72", "value": 6419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050071, "uuid": "ca8a9104-a1bf-47a2-92af-e977313366df", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050071, "uuid": "08fd41df-4e0c-460d-9251-6fd3c92d2a6b", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f84571-d269-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765001272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001272, "uuid": "4f7d5483-2f1e-4867-a3c5-eb3a58c3f248", "comment": "Malware payload (Mirai)", "value": "2148cf7393e92df791a199a366d60e88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001272, "uuid": "fa2b63a7-c66c-480d-8748-7d250fcea54b", "comment": "Malware payload (Mirai)", "value": "e9b773290ce320612bfef2322f5d93e05bb863f83450e06efe67682899cf49b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001272, "uuid": "a0a9597c-e0ba-4023-a856-6112ed977077", "comment": "Malware payload (Mirai)", "value": "19a254a9f3d2721938c62c9ca617400e3c5cb87f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765001272, "uuid": "a8733ce1-d6d1-4ce3-85b7-95d7285628f1", "comment": "Malware payload (Mirai)", "value": "db8380827efae1835eaa1e8d17d1308337de99437dd001dcec1388230f8263f33d2b580f1fd2f5e88bdf17cc61400c7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001272, "uuid": "a336dfa7-8d89-486f-927d-5e4ecd797181", "value": "T15F0302D11321178C8366EB783DBE701A8538112B32E51E003D97E64EE64F725987BEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001272, "uuid": "ac1c97f2-4672-4c6a-b012-985b23e81900", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTGv:87vbq1lGAXSEYQjbChaAU2yU23MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765001272, "uuid": "69443ff3-14d4-4446-bd78-1e0f8371b7ce", "value": 40486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765001272, "uuid": "6568c902-bf5c-4f0f-ad2b-f4326929bdb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765001272, "uuid": "74c4bdff-4f80-4a91-9d46-865ea9d5eb60", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8541cb1f-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050072, "uuid": "e15d6a65-c4a0-4b92-a160-42a7935a9407", "comment": "Malware payload (Mirai)", "value": "2d0c2833c49025c54b588e8072cc77a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050072, "uuid": "b306c7a4-f2a1-4118-8a20-16bf64838ab4", "comment": "Malware payload (Mirai)", "value": "e9d8b0c1b91b2b345ae90146e56b88b418db3158c33999bf92759c9807e93c39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050072, "uuid": "b2870183-cf68-4e45-9eb2-cb055529d2ba", "comment": "Malware payload (Mirai)", "value": "943418905885e2216140647f8d48e0bbb7f498c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050072, "uuid": "db635281-9c65-488e-8c3e-6a457c805ed0", "comment": "Malware payload (Mirai)", "value": "bd0e5910ba35bbadb51baf927c2b8dbed3c13ef866260dab3e61ee67208bf89cbc40f13f079a89aab5c62d96b5e29f9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050072, "uuid": "808f8455-de1c-4e56-af2e-71cb3b7e5a3d", "value": "T183A338D7B801DDBCF84EDBB74453050AF571E3A219831F36636BB967EC391A41826E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050072, "uuid": "4d2e90da-7f21-4c3e-8e09-db7c983f0853", "value": "1536:pr43pWv1r+DbIhE820mY1bu5yClm8IxDrAG+lZ8GBbffDqNQg6VgK2ff:6DE04bu5yClW2ZNBLg6VgK8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050072, "uuid": "4337e295-fb0a-4eef-b034-d6d3851c15c0", "value": 98712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050072, "uuid": "ae15d913-7291-4b6e-a1d3-f480e6a0a569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050072, "uuid": "e6e3d10b-2b10-4ceb-998d-e4d26fb3dc51", "value": "nwfaiehg4ewijfgriehgirehaughrarg.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e761e65c-d2d8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765048948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048948, "uuid": "655d0e20-8ee2-4395-9b4f-e23187f8ec0a", "comment": "Malware payload", "value": "0382d5c059717bf4a08b93460edacb56", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048948, "uuid": "c69ac1f8-40b7-47ab-8c56-f80609fa5cb6", "comment": "Malware payload", "value": "ea3e9e634cb137499c4c595245b725cd8a466db9f01fa8b7a09f2750492d892c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048948, "uuid": "a5689a82-91bc-45b7-be33-ec3b12f361fa", "comment": "Malware payload", "value": "39120e443d4c88299575947235b41ecd2c1eb733", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765048948, "uuid": "94a02e61-ad1f-4716-8f28-f354518caedc", "comment": "Malware payload", "value": "b81419be85def76d49dbc7692adb4e9ea6d4dff473675a70ffc9b6193ca2fe466fcaad63a997b81c2d0db7d7c110ceab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048948, "uuid": "655a08aa-0eda-4788-a378-326ec8ecd6be", "value": "T11221F6DBC10063EE60D1DDC9BC90CB00E51AA6E1AC806FDCF6891C7B10AAB1D3406E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048948, "uuid": "15b0e0fb-73a6-4bb4-a691-aaecf730d914", "value": "24:QvZi4w8gFw6NRPF5HLz2Q8/S1AMf/hNIKA3h6K4y/O:QvZi4whHPzURMQ4/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765048948, "uuid": "dd6f71a8-a2c4-4ca3-ac0e-86152a67a29d", "value": 1227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765048948, "uuid": "f9dc3546-1afa-4f05-8795-feffe1b8c84b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765048948, "uuid": "6d5caa54-b143-47c8-be58-564b65b7e8a8", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a27ba2-d2b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765034265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034265, "uuid": "0a33a142-ae56-435d-9e0a-a3022b3a6a38", "comment": "Malware payload", "value": "8521e49e73a8fbf96918a38621610743", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034265, "uuid": "898e24a3-c725-4de6-93ce-e2da9c895a3a", "comment": "Malware payload", "value": "ea92a95e8b7a7d7def66c0c579171ae88d3e04916a1787f97ad68c7f36c271f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034265, "uuid": "f4588bf4-5ad5-4180-8b27-b873830dd5f0", "comment": "Malware payload", "value": "244e4e9f45d0563290c869f5b229630b009df604", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034265, "uuid": "2ecb2850-b383-47dd-807d-6f73d92a02d8", "comment": "Malware payload", "value": "3096a89f6e60a372d000f16589f93ac9578a42ab01d6903aa3c1d00ee81e18b7f431fc45d5b00f3b6d2de0fec37e32b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034265, "uuid": "3a1b6cdc-d261-4f61-a46c-764c9d208445", "value": "T174156B74F5A6D84CF44AB531C02D317D8BACB1F7B6C854E61C2C4BCEB40A915EA235AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034265, "uuid": "ba06e428-6767-4924-bebb-dc0d747fa021", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034265, "uuid": "cf33162a-92ec-441b-8646-ddc8c6d49de0", "value": "12288:+XPSKGeEPuG03LfNRZvQOxVfNraZ8uAfmqC9BLbrPKenK:+XPNG7YpPQCV1raZ8ihtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765034265, "uuid": "55328bf5-484d-417d-a45d-c24e7d601fb8", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765034265, "uuid": "05ccfda9-9841-4a01-8b4e-6d1216792991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034265, "uuid": "4016ca51-6fad-45b0-b44c-889117f039f4", "value": "System.Collections.Modle.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb759170-d26b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002167, "uuid": "40aa490e-98f5-41a3-b425-c4048f962819", "comment": "Malware payload (Mirai)", "value": "e811d24c91a4e7ba5365f57b9af25a9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002167, "uuid": "a56a624a-822e-4146-b14a-d4b4962299fd", "comment": "Malware payload (Mirai)", "value": "ebc4c0155830aabb54e3b540a481b96cec18cb47a361a6cf15bb93804319f338", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002167, "uuid": "b9375773-4b07-4d99-969f-7fc70e3f7dc6", "comment": "Malware payload (Mirai)", "value": "c984add2705d2980dead1281408ab8aaef1360f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002167, "uuid": "7d77c7d5-cfbb-4754-a278-1ed8529985fc", "comment": "Malware payload (Mirai)", "value": "1dd07594275a441ed99ddcbdaaf1d2a39831fdc10ebb320fc0c2c388c1b4b237c57d3ca9a5a35ebd959a2b89cb8da4e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002167, "uuid": "9256adf5-0093-4673-b98e-2abc48625c47", "value": "T155042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002167, "uuid": "928fb908-0135-48e2-984e-74a97c874b1d", "value": "3072:O8/Ws7hjlvbAmfkIaboVSyckpj/HS0BpCi/hJjogM/REC/HV6:O8/plvlcIaboVS7kVdBMi/XMgM/REC/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002167, "uuid": "759c57cc-0338-4bc4-9c2a-2fca7acde730", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002167, "uuid": "22e22568-e2d9-4573-9949-89cb74f42700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002167, "uuid": "ee7f1d2f-f720-41ca-a64c-e6dc031e4abd", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae13708d-d2d6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765047993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047993, "uuid": "bd679c87-3a7c-4721-b57e-088dc2fe4213", "comment": "Malware payload", "value": "fd260e4849fa91414439ced74b1a25e2", "object_relation": "md5", "Tag": [ { "name": "datareportnew-s3-ap-northeast-2-amazonaws-com", "colour": "#D14540", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io", "colour": "#5EA0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047993, "uuid": "81c0081d-727b-4c26-a59f-cb15bcb95a76", "comment": "Malware payload", "value": "ec355f76ff1e54054f660e86853bfed9f825f2aa21ae85831eb2d3e6930fec25", "object_relation": "sha256", "Tag": [ { "name": "datareportnew-s3-ap-northeast-2-amazonaws-com", "colour": "#D14540", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io", "colour": "#5EA0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047993, "uuid": "8b33743e-10ac-4dd3-b18b-0b93a5fe1af0", "comment": "Malware payload", "value": "7093e8b50804c5f3f6dd4106b396d148ef203841", "object_relation": "sha1", "Tag": [ { "name": "datareportnew-s3-ap-northeast-2-amazonaws-com", "colour": "#D14540", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io", "colour": "#5EA0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765047993, "uuid": "3e183f0b-c359-467f-a311-5c77d7c5f15a", "comment": "Malware payload", "value": "c817684e1cee0c29b0a0b56d790062ac95a30860da2cbc3452fabedd54d8f1ca9fc237b1b55d0c6206bd2691f882c6a0", "object_relation": "sha3-384", "Tag": [ { "name": "datareportnew-s3-ap-northeast-2-amazonaws-com", "colour": "#D14540", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uu-goldeyeuu-io", "colour": "#5EA0D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047993, "uuid": "9d1796e0-3d30-4948-b181-bfcfca0e513c", "value": "T1CC323A574A247C82CD469E30B0C68E27EDB223752BD4A0D32164C0A59FC53D62B985BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047993, "uuid": "2bdedc60-5485-47bf-99ca-295343058060", "value": "f9e95c5b61396aa48d6dacd8e2ba38bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047993, "uuid": "0d2a9abf-f0df-471b-bfea-62f39f91ba36", "value": "192:Cd34LbWggnLSa+iGULc8pq8RuwdmL4pUQrNyuJy:Cd3+K2Wy8RbmL4nNyus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765047993, "uuid": "b9d82bb2-eb5a-48e2-937a-f841bce80894", "value": 11768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765047993, "uuid": "80ad643d-99d1-425d-859f-fe4f79571765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765047993, "uuid": "7f124f2e-6018-4c70-8952-a5c5ea5b1197", "value": "DataReport.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b484f2-d2fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765063598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063598, "uuid": "10fdd26b-0a5d-48f7-a7de-6feb9eb2cdec", "comment": "Malware payload (Mirai)", "value": "231bda5166b73d20dc394d975a495bed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063598, "uuid": "e252c3c0-1db7-41fb-8b51-fc6f0b1f0b53", "comment": "Malware payload (Mirai)", "value": "ecbf6819b9914bcda43f75be697722548a0b8a98640229df64544721c2d89457", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063598, "uuid": "83b3d0d9-2506-49b5-b1cd-4dc7ca790889", "comment": "Malware payload (Mirai)", "value": "bf8567e05bdf0411793ee9b26ccfe60ec3564ca4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063598, "uuid": "65e68ff1-74d2-4bab-9212-b4237375b445", "comment": "Malware payload (Mirai)", "value": "bc5d9c0b2f338b07b6c1eea1a3f5fb0b6ff424c973b67db29aaed2ab8bec321fc88236cdc259e88fb513a192c5b4d29e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063598, "uuid": "3dfa3419-bd0f-48d2-8069-db699dc85b4a", "value": "T1A4534B56B8C19613CAD0227BFB6E428D372613A8D2DE7317DD266F20378681B0EB7751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063598, "uuid": "f55a7288-0c6d-457a-89c6-770fb7670895", "value": "1536:U1BxO7Z4mQyDvIVHuX5ky/9cPW1PSOWAMvIEo3mvdmz:U1Btbu9cPAJMvIEOm8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765063598, "uuid": "5bdfb402-6fca-4ffb-8a4b-c15f09424d02", "value": 63120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765063598, "uuid": "153e5c88-3835-4603-9478-3c116d946666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063598, "uuid": "c7bbd828-8545-42ce-9357-8207958c3cde", "value": "fent.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f7682f-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003125, "uuid": "20732149-95f2-4afa-8025-22ce92bcb098", "comment": "Malware payload (Mirai)", "value": "42afdf3ce98c3850888c1e85820e3499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003125, "uuid": "6826370e-660d-44f8-9405-e6079b169104", "comment": "Malware payload (Mirai)", "value": "ed678e7aacffd073c5cba2636acbfb43d5e17a54e16f9db2c27b14a79b40ad5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003125, "uuid": "09f3a50e-6f75-41a3-ba3c-ff850330e19d", "comment": "Malware payload (Mirai)", "value": "883d14ed25be9c625d4820ba7d8d85602c8f8c62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003125, "uuid": "986969b2-6a3e-49ee-88ab-40eb13c47c88", "comment": "Malware payload (Mirai)", "value": "fa3e26a7af9a6da0ecd0f0f24bca6d48e42ac2785318bb72bdd8a12b4eb5b05d7e63419bd240e92776a060f619dfb45b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003125, "uuid": "2776ef5b-4600-4af6-a92e-bd1f2d946b6b", "value": "T1C5E33B46BB418A13C4D527B9BAEF42493332AB6493DF330689285FB43F8675F0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003125, "uuid": "624f75aa-72e0-4262-b44a-ca70c7bff662", "value": "3072:zmqqvv3PdXhdc+hR+Vbiv/OPuUMRi+FD1uCXP7136M/9tK2r:nqHP9UVby/OPuUM0+FYCf71KM/9w2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003125, "uuid": "9f6fdfe4-6eaf-4f10-9ee1-244b72fd91e0", "value": 152356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003125, "uuid": "b253c87b-e1e1-4a34-9116-7ad6c1548f3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003125, "uuid": "c7507a3a-dcd4-48d5-aa38-25f717e7c2a4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711ccde3-d2e1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765052615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765052615, "uuid": "cb52f9fa-215a-4f68-8b02-90e9f7512250", "comment": "Malware payload", "value": "fe7394962cef551d1744519dc223f88a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765052615, "uuid": "6b5b6d3f-0986-4515-9434-4fe29e6d67b0", "comment": "Malware payload", "value": "ef834de6f9c821dea69228130d3093ede25812905a4a8bcfa025f6fa4310c2cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765052615, "uuid": "907491f2-25d8-4c34-a23a-b11af1c1193c", "comment": "Malware payload", "value": "29a930926b3e6241f1f917c9174a3a8c67d32a71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765052615, "uuid": "524d9986-eebf-4b5a-a87e-5fc0a691f0fc", "comment": "Malware payload", "value": "961914242bf6cabeeea9b95505afd1f146746ce9d1eef0b09cf26724bc8d13d1663ec0d619811a3cd54da97be67486e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765052615, "uuid": "0b01d385-0576-4fc9-901d-e5aaed78c2d8", "value": "T1B422A81AD51765F2CD1A08B219DBF7EFAF703A349031CC11EB60DA52AF93C2A6518B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765052615, "uuid": "2138f076-04b7-4e5a-ab13-2d9c84c10a71", "value": "192:tbN88Jf/+7+h8oEMjxCK1ULb7bf6HLGcVhuzYNtcjcwVyF6O2l:he7+h8mNCK1NIBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765052615, "uuid": "2614193d-40be-4d35-85a8-921fd66e5059", "value": 10880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765052615, "uuid": "5adf5818-4409-4914-beef-26aa7e050649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765052615, "uuid": "fd524f40-13db-4ba4-8bed-965f35f5db70", "value": "SecuriteInfo.com.Trojan.DownLoad3.40744.25507.28898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede4bbd0-d2f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765063132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063132, "uuid": "7b6585c7-1adf-4c4e-8eda-90f016e1d852", "comment": "Malware payload (Mirai)", "value": "c92e68a716b5729997706024c64da04a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063132, "uuid": "5450f0a2-40dd-45f7-bd74-8ba7d74ca9a3", "comment": "Malware payload (Mirai)", "value": "efcfcee111b69c7c3730d7b429449736beb267277a83635be1a48a8aec6326b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063132, "uuid": "dd5edf43-418b-4d4b-af2b-7f752aca96d3", "comment": "Malware payload (Mirai)", "value": "7ac2f53716f333b6bb9979c417c890dc906c274d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765063132, "uuid": "918062f0-7cc9-4830-a2d4-fe77def8de19", "comment": "Malware payload (Mirai)", "value": "06e606cdb7b52473f16c1443511f8a9a1974d423adce52a7df0e270c2497c73c081d451842c2dc04f1832f311826b337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063132, "uuid": "ac13d3bc-b14f-45e3-aca2-c2580f4f1f0b", "value": "T11083D71E2E21DFECF769C63447B74A21A39833D637E1D581D2ACD6006E6038D645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063132, "uuid": "a0f1f069-4351-4d39-94c1-056940451fda", "value": "1536:DCwTzOltsJYkfTmGAWEue96uxJeMxyHp4:DlUsCjGAWFe96ux3yHp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765063132, "uuid": "13762fb1-9ae9-4b34-aee3-938419d07aa7", "value": 80848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765063132, "uuid": "6f13288f-86dc-40f3-a1d9-5e12922935e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765063132, "uuid": "10c8c9dc-966a-49e0-ac09-7ae82226427d", "value": "fent.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc8d8ba-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038654, "uuid": "11488908-7505-423b-accd-cb6e43e80adc", "comment": "Malware payload (Mirai)", "value": "e3e2251b188ca1dbe859702d71542ba6", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038654, "uuid": "10edf8b0-49ac-4894-9199-715879b28269", "comment": "Malware payload (Mirai)", "value": "f0a5305e2037fe27c39ab6ede77b939a143512e8c3fb26d3631af85210c71e21", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038654, "uuid": "ad88c90a-73ea-4dc8-89a4-b6a567666b0e", "comment": "Malware payload (Mirai)", "value": "e36bdb932bce54a0a0741915a1261b8f93f9528b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038654, "uuid": "19fc8fb6-a690-4859-8bca-a05579447d19", "comment": "Malware payload (Mirai)", "value": "422663d6877e682650a1cb708146bd090e92ed05a2e1183ac841b2b7ae5963a80816c8edc7a5a17afaddf8fb30b0ecbd", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038654, "uuid": "b5b451bb-bfe4-48d4-a1ff-09ecd4fb5a99", "value": "T197F3738A7F903FFFD81ECD3602A49B0A129C59096299BF7B6A34D404F64B11E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038654, "uuid": "abfa95bf-b854-4d2a-b48e-972a7e54d4c6", "value": "3072:egt4sL+zVRWExLpnlvy0GPtizVXb30YjN:eg2sq7bnlvfd30Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038654, "uuid": "04f5357a-68d5-402f-a503-e994633e839d", "value": 168724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038654, "uuid": "1772250e-a673-4bf1-a1b4-180fba19d0e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038654, "uuid": "40ddd47d-62bf-43c3-82aa-dc021e4f5d2f", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec31434c-d248-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764987109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987109, "uuid": "e623d0c7-cdd7-4cc2-a89a-19673678b88b", "comment": "Malware payload", "value": "cd70aae059394a6990b81ec42a9d0079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987109, "uuid": "a500989a-f851-4f49-9601-4caabdf8a407", "comment": "Malware payload", "value": "f0d3d5668a4df347eb0a59df167acddb245f022a518a6d15e37614af0bbc2adf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987109, "uuid": "daab2bcd-b9ec-49bd-86e5-c6b3270e3cb6", "comment": "Malware payload", "value": "94992eaa2a98b040200f4fb899e03c26e6a355dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764987109, "uuid": "5f8bdae1-cbdc-4817-8df1-a3661448bba8", "comment": "Malware payload", "value": "35a9eafaba70df2d8cdc6d0cba6e4b4bc4bc53dc41c01d3863fb891bd8f888f7c10d727519743632f60ed7ff83f5364a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987109, "uuid": "2b06c568-3211-4a3c-81c8-585e2825116e", "value": "T1A92633248605FA1F4CD84B756F7A6992C20034DD2864C2C9FBC9FA08673DFA7136EB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987109, "uuid": "53b896ea-aac3-4347-b1f8-d262c7f9ceab", "value": "98304:2+2fhHBcSLVRrN9FBJMlZlG9pF9D7H+Lt2e0Yosvov:2TfhhccVvBJMo9votEYosvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764987109, "uuid": "ec159ed2-014d-472d-9699-a828e8ca15dc", "value": 4455384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764987109, "uuid": "fa3d9c62-686a-44c8-a9bc-e7d22b5824d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764987109, "uuid": "a1b488d5-df23-415f-b5ee-9afa1f03dcd8", "value": "test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffda0782-d277-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765007328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765007328, "uuid": "22f92472-6d8d-4e3c-95c5-b128566337e7", "comment": "Malware payload (Mirai)", "value": "b5e6eeb9584604eee1e86f28af820736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765007328, "uuid": "ab64cd20-8a82-449e-8cdf-febb9b17cfab", "comment": "Malware payload (Mirai)", "value": "f0d7396218d9fa16db9240edf3e9c57365b772a7bc43841285b7746b1aa4bb92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765007328, "uuid": "bbd6a326-cc9d-4b12-9dd4-d472fa843f3d", "comment": "Malware payload (Mirai)", "value": "e2f0ba86fe44efb85d155a7353f467f49456a5c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765007328, "uuid": "407ad605-1bd1-41e8-adbd-3b82f1e41735", "comment": "Malware payload (Mirai)", "value": "a117dc7160dc9f552d84d52ead1bec7c86841b54eb8b62a0adc16b774bde155feaf2a6afb62b15a8c45b64328bfbc083", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765007328, "uuid": "0b64e11e-44dc-4da1-9ed8-e6e10eba644c", "value": "T1D6730227A8D69C4BE7E3A33719DCFF4B3C8561DD1DA2A1C20FE4562D500863AA729347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765007328, "uuid": "d5b088cc-fddb-4b45-bd02-2f98faccd0e6", "value": "1536:HJQcfR4xR4k9WpuNwY8rxEX5jf5kayPhgoM1r39bh7jrgty3nouy8Gyz:HT2epjrxk5eVPhcZ39bhngQXout3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765007328, "uuid": "e58e23d2-0385-4b2a-a56e-81666837cac4", "value": 78896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765007328, "uuid": "a881bb65-65a6-4d6a-83c3-39bde733e631", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765007328, "uuid": "cb6dcaf5-980a-4fdb-a488-7f0ff2e8995c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83eb0841-d2db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765050070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050070, "uuid": "1728759c-96ea-46c4-844d-bd33d39a4e01", "comment": "Malware payload (Mirai)", "value": "8ce29621d32a0b3ed32cbdc88b3b11aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050070, "uuid": "f4d29ae9-1fce-4854-9308-c54ea69f2482", "comment": "Malware payload (Mirai)", "value": "f1660938cf7cbc9e7aa590b24cc315d219f29496a7aa7919d0d9dfb2311bf905", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050070, "uuid": "6d91df31-934c-490e-8605-19d5f4e43e93", "comment": "Malware payload (Mirai)", "value": "6acae1cdc887d08b3e9b8f82324428b7ae8bb19b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765050070, "uuid": "b7bc0818-4b32-4bdd-8cbf-e49855c4f5c6", "comment": "Malware payload (Mirai)", "value": "39b74c4fafa5a2830e5cf40540bc0b86e9e09338e3384653d15fdd32b6b1395119d4c3ba01dc7a7b185cd5d902806fb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050070, "uuid": "33865ef9-3534-4c39-8360-8e0614dec913", "value": "T19403F28351F9A080DEAF0A74B271361A1458C33D95818A77D28EF44A3A07BF38B1F792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050070, "uuid": "48629442-de54-42f2-8056-fde9a4d8703e", "value": "768:GlkIT3fVwO/vsJ/9pFcQfm3f84QPCsWz7nmxleWMjLGnbcuyD7UtQRj0:Glkg3fVwOcB9TcOm3f3Q6tUleZjLGnoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765050070, "uuid": "3b2bd624-8b90-4aeb-b74b-9fcf177890d9", "value": 40284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765050070, "uuid": "32972c67-8ab2-44ce-bb79-114fbdbde5e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765050070, "uuid": "a6a89bbe-d9e5-4fa0-8083-929b9dd30be8", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c6101e-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765033834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033834, "uuid": "534fba14-7d62-4be1-8260-f02aa7d98f1e", "comment": "Malware payload (Mirai)", "value": "f38c694b6fe59f420555d0cc9e48d12c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033834, "uuid": "178884b8-6555-4512-ba1d-5cde88cf76c2", "comment": "Malware payload (Mirai)", "value": "f1c4534806909cf8feebe86d11cfcfad58694f6f78339f4d051c78be99e6a31d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033834, "uuid": "913a6991-a418-435e-8151-10080282a033", "comment": "Malware payload (Mirai)", "value": "ff41e7d0bb93cb25d66541730fc4e4a66702c6ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033834, "uuid": "09abbbfe-3abd-40ad-a220-b600214e3bf2", "comment": "Malware payload (Mirai)", "value": "a70d33ea7ac4d183fecf8ccd9e15a851438a42d4a665d709624790958d4f6b4e281a0aa6e78647951805d75bc7f73425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033834, "uuid": "24eec3dd-3f62-4ece-be9e-cea8e023a396", "value": "T134A2E110552FFD78D7708832DF61DB867742A2B5C6F978632B080EF869450037BB81A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033834, "uuid": "94cd7730-ea0e-4f85-a0e3-1e27916cf696", "value": "384:CgLEC5rX9ikrP18Cxncl8CtHkobn5/B0xGxQGmn+kpRJ+iqgwPhymdGUop5hyJ:CoESNiC8CxnUdhD55uwXmXJ+idwPs3Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033834, "uuid": "61782fe5-e8f7-4524-8842-2a58debcafa2", "value": 22476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033834, "uuid": "1251d46d-2419-4dcc-a4be-5fb05610507d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033834, "uuid": "60d932b5-c644-41e6-b12c-fd6dfa348d9d", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1098374-d290-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765018014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018014, "uuid": "45ead82e-f05c-4083-a001-ff3db8007577", "comment": "Malware payload", "value": "c3f204c99f37a8631160ae0328ce1364", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018014, "uuid": "f8d745d9-cc31-454f-bf7e-0ec5522293fa", "comment": "Malware payload", "value": "f21b3b47477b0944b667cec27fefc52171f54f0410ecdc0671f639e98e4f15a7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018014, "uuid": "b1a9664b-1ce2-4126-8c53-1964b96d96bc", "comment": "Malware payload", "value": "4da3d3af77a36039a47b0d26c7f904bc158ef661", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765018014, "uuid": "2a4ed5d1-e2bf-4d79-be3b-f71c08441e73", "comment": "Malware payload", "value": "e7831b62d1957ba4ce3c75a393e1208a2af9a11d811c8412bede47b80bdd87cf335b6ed520da915f7b4fcc973fdf6c6e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018014, "uuid": "32068a16-b81b-42c7-a290-0924f3402ecf", "value": "T17E73959A19CF80FCA967386C46DF9C4AF7A58503472EC6C1BF4DA5A02F21839D2F59D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018014, "uuid": "4a880569-b4a9-4ffc-9e5a-a0c7ff76d3d5", "value": "768:3jYuv4N8qq3TqPSxMTlygt9Sv9ka3Y57txwTswA1IF33mYxpIeuY5FY1Z0CqNZuN:tqPSMQz3a0WtY3P/XCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765018014, "uuid": "c086a299-425b-4d68-b0b2-9090e1f42dda", "value": 76935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765018014, "uuid": "f0d319b1-bd91-4a51-9ca5-acedb1fc6f0e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765018014, "uuid": "a5a24f23-fdf8-4d82-a1d0-f3e13c22d48a", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f6404c-d2d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765049182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049182, "uuid": "e3b5f521-3517-4247-add1-adacadde6917", "comment": "Malware payload (Gafgyt)", "value": "1847b753a4c31ad6a6b3f2166f41e5d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049182, "uuid": "f9b77c62-a518-48de-8543-49acb3933580", "comment": "Malware payload (Gafgyt)", "value": "f2bd4a9ed8666dc4a1c7b0baa5cce122fad87ad915e6f4052fcaab678611ef31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049182, "uuid": "a318dc11-94f8-406b-93ab-ddb90fd4ed7e", "comment": "Malware payload (Gafgyt)", "value": "d53ad213453ef3fa5a375f51380688b643f5f777", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049182, "uuid": "f0c9e47e-195d-4598-ae8e-cabb59067a43", "comment": "Malware payload (Gafgyt)", "value": "62cd4832be569c0ec2151021275d0478cfc7d9d6aea3cbfd5fdc0d4448d70ebf806c0b7b34732738fc8c75c2d9908247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049182, "uuid": "2c630fed-6a71-4ff7-bb8b-4766f9ac3501", "value": "T143C3842E7E12BBBEE668863107F35F70879521D237A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049182, "uuid": "5b20499e-326e-4ad2-878c-7a6cecf7eade", "value": "1536:g7je1TYGq+f+A02rKXzeve1eTe8p2rKXIeum+40GAzQj1l72HBe8ERLGf/rmW+IR:/a1UR0MZQHeBq/rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049182, "uuid": "2af66e45-aa17-4f82-bb4b-b6e3bcdc82db", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049182, "uuid": "bd78a0e9-33ca-4262-a004-9e3539507a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049182, "uuid": "48b78d56-2eda-4a29-b21e-3e8c4027e722", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e58e024-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002413, "uuid": "dbb6d1e4-ba95-4de5-b27c-84ea0e7e96e3", "comment": "Malware payload (Mirai)", "value": "77cc66e0a9eed33ce52b93a2c7852580", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002413, "uuid": "5409ae27-ae92-4ae7-b3c5-259ec01e4016", "comment": "Malware payload (Mirai)", "value": "f2efc50b86c736baa592020f85ccf04f884403ea55dd3f2168c49ebfdadb05cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002413, "uuid": "4d7895da-b112-47bf-a0d9-483bb0dd14c1", "comment": "Malware payload (Mirai)", "value": "1944107f62b05ed08c927a228ec386706d2e6144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002413, "uuid": "b8865490-4533-4379-a805-da78c3a8c37d", "comment": "Malware payload (Mirai)", "value": "308604bbf1a45308cb22e48edead97928fb0004a8f74fae754afce3616d5fc752721501a0f435a516f643b349b882bfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002413, "uuid": "1157b3d1-e1a4-4135-93dd-cfa623b81512", "value": "T1E5B39E21C4745EA4C1564530B8E9FE361F23E9C09257BFBB6694C3AA5083EA8F505FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002413, "uuid": "da29d3ab-5484-4971-8ae9-aab805376c20", "value": "1536:NakKmsU6ffl01IbrmFuBGyUW3JN9ZqDTAK3462xpVy1CoWggaHU0T2A5Up1+:NvKmsVl01msuGyRHq3H3apVy1PUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002413, "uuid": "98486289-b801-42c9-83e9-78672d7f19a3", "value": 112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002413, "uuid": "b7fed96f-dc39-476e-acef-78e4f4365f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002413, "uuid": "76352d6a-0d06-4075-bd0f-d3614ba5a7c6", "value": "colonna.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4fd4e7-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006116, "uuid": "656376cb-fade-4bc5-955f-c14cc0a4ece9", "comment": "Malware payload (Mirai)", "value": "fb898a07caeff8d8ca0df6aafa06d362", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006116, "uuid": "0e9c7e5e-5b19-4846-b07f-f22a6a8f14a0", "comment": "Malware payload (Mirai)", "value": "f4f91714d32529b822ba75df546714e37ec244b7a9604b7d10225e15e7326f05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006116, "uuid": "881c2980-8173-4f4a-b68b-ece9e095cd92", "comment": "Malware payload (Mirai)", "value": "458d3d2e6dd7609a4dd335dca591efbf4fb6ac4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006116, "uuid": "764daa85-c238-476c-a2c1-48de2b301fd4", "comment": "Malware payload (Mirai)", "value": "70ae681f9e75f91093272682e211e44f4ca9fd3bb2a7c4db8c8f57d34da07cc69205fdeb96d9acaa23ad17ef4aebe573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006116, "uuid": "853a30db-ff01-4b29-9612-e274891620fc", "value": "T15B210DAABBD23D1BCDA4023BDD9F5764A322DF9891EDB503F30612010C2F3240F22289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006116, "uuid": "9c75b37d-5c52-4e90-8299-889a6cdf00bb", "value": "24:FyB0rDdja7jgE0KSY466lFS64GvMHdH1JGafMsIaJXlxrNb4v0:FPrDI7iT+WFS64WQUsIaJXlxrNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006116, "uuid": "724279de-6197-4a8a-8662-7dc6c0633f03", "value": 1332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006116, "uuid": "f502cf98-e93b-4144-ba39-21644959913b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006116, "uuid": "f543fdd5-9b9f-48e9-a273-53af32d03dbe", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad41033-d2da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765049625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049625, "uuid": "fe25be7b-66d8-4e3f-8507-00b8dcf4cf75", "comment": "Malware payload (Mirai)", "value": "e22bbaa1d1bc3b810ae92c81d29b0c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049625, "uuid": "b6cf3c63-2be9-4d5c-ba58-61b74b84c0f7", "comment": "Malware payload (Mirai)", "value": "f53a6ecf45d009101914b646413510925dbbb4186f33674233ba0dbd489df581", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049625, "uuid": "e04aacaf-940f-486f-ad35-e9572818ed34", "comment": "Malware payload (Mirai)", "value": "34aebce974b3775a6b5a80e94bcca19d7106707c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765049625, "uuid": "6987d7ca-f076-4f26-948c-6a0fca793274", "comment": "Malware payload (Mirai)", "value": "53453c8dbfdd9b1641a780fdcb9d463e065598c6a33218ecd8ec1bf6b5d6f2164e37956319e9681b57f3c474728cfba2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049625, "uuid": "19faf556-3ab2-495f-9700-29aff21c92b0", "value": "T180F43956F8808F22C5D125B6FB5F82A8731747B9D3EA710699188B343BD782F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049625, "uuid": "3b25d279-7443-4aad-bb44-c4b47c0f9959", "value": "12288:Giu9wULqlMU5CDADLF0+XuD6tHi1uqnI05YdintR8ppExoNYwPAqRa:7umULzU9HFbXU6nqnNXmYqAqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765049625, "uuid": "ac9fb62a-d89c-4cf2-a2bf-cb55f36a6a12", "value": 772600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765049625, "uuid": "64e0c6b7-5812-4060-8166-9d5e1fcd465b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765049625, "uuid": "05f4b46d-c71f-4061-a51f-35e0d12eaae6", "value": "arm.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ec64a2-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042152, "uuid": "3df1b594-5d78-4dc7-9ebe-b28ac969d486", "comment": "Malware payload", "value": "44aa63186d38cfd5c46c83bde4789459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042152, "uuid": "d7dce760-d132-420b-ad26-a6d2e64315a0", "comment": "Malware payload", "value": "f61055630f6ec93652be25700bc48b6db997560cf0de1f7b3132ba7206603688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042152, "uuid": "52af1786-8476-4063-86db-4854c9784969", "comment": "Malware payload", "value": "63093931a8b0224b0d47681bb3adda250c31b84b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042152, "uuid": "5dc98423-b6af-43a2-bdca-eb809ad7e4f9", "comment": "Malware payload", "value": "ce163c547ebd25846c315ab1d363734c4d5fcd17e7bb9a72bfee188ab345a4b4c6aa5cab79dc00c454574eab7ec7a7ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042152, "uuid": "757546a6-4255-4133-8046-3c984cc5ba8c", "value": "T1E882F70233F84224E17F6B396DB201695972FC7A9D35EA4C1CD9106E0DB2B84DB61F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042152, "uuid": "65603d7a-6242-4b1f-92b2-852f8374d761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042152, "uuid": "705229fb-e480-4c11-b3c5-2d8ebd1a2f7f", "value": "384:2aM8+lCO/5vgdW3cOZE9mYZw9QOlg9cI3STt9fqKyOOnV:rMtn89uQi2KyJnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042152, "uuid": "9ebbd5ad-916b-4d2f-bf09-9ca77e9e8709", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042152, "uuid": "042bfd96-3cdc-450c-9d7d-25c187fb2ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042152, "uuid": "9b8b3561-5a92-4df7-b5aa-91cb5212554c", "value": "agent_fw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86552763-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002400, "uuid": "98b6e27f-4ee3-41ee-a9b9-0617d69957e8", "comment": "Malware payload (Mirai)", "value": "3c92d9f40dd72c9d4cf8963ca8917fc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002400, "uuid": "6bb9fc20-ef13-4c2f-b629-6c58b05e7600", "comment": "Malware payload (Mirai)", "value": "f76d8568f0f331d8c4a118aab5fc4df4de3c502b20b5c5d13a02575bdfe98d9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002400, "uuid": "e41a38c7-0116-4c19-a64c-c85a82749629", "comment": "Malware payload (Mirai)", "value": "56afd851eb3e1c6f924c18e7163187f24bd2e957", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002400, "uuid": "51408e3d-fa99-450d-9589-c7d86bca2373", "comment": "Malware payload (Mirai)", "value": "1e1ef83ea44a182b4a5be1bfaf3b0ec7206a1c363ce9b6cd705b5b6d1aae5d6915e99422e06641e5fc64bd1a23f2f6ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002400, "uuid": "b82dfe2e-e41e-4e7a-8ab3-7e2439d44ce5", "value": "T11FF3E81ABF610EF7ECABDD3346A91B0528DC580722A97B75B630C524F54B24B1AD3DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002400, "uuid": "cd21a756-194c-4261-8a5f-a93a6d20b01d", "value": "1536:+B3nVrGj9fU9BXV8CPuuYmdDkgXyT1EtQki/EMpQ4WSDoByZ8/5RiZ8a5yzjrTf3:+B3nVrGjl9orBEpQ4oByCBICjhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002400, "uuid": "716309ba-8f87-4a5a-a11f-5eb7e3d00235", "value": 159668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002400, "uuid": "c1a40217-70ca-4b44-90af-779a0fbc0bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002400, "uuid": "efa0ad2d-b085-4672-b533-c6162dd3fdd2", "value": "colonna.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfc2eb1-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038675, "uuid": "0ee86aeb-9a33-4af1-b0f0-3b7a60c85c5c", "comment": "Malware payload (Mirai)", "value": "a35e3050deccc29d4851c8f88d07a3cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038675, "uuid": "f9e66abd-4c82-44b8-9c18-120ab657648b", "comment": "Malware payload (Mirai)", "value": "f77083273ea3a5cb7141a5da898e62bff34d24e52ebef833e91e5f576b7f1168", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038675, "uuid": "d7f8b1f4-b678-4308-984c-e37d9204bc30", "comment": "Malware payload (Mirai)", "value": "6be1fc802a6edf6a24750df06846a51b50f54787", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038675, "uuid": "2a135c6a-4360-411d-aae4-82043dd2d574", "comment": "Malware payload (Mirai)", "value": "80c94129189882c9a27409f020cbbaa850d50c0b66ca0194c2f9331564da47371641f609a2928dc6678c0c7d0564bc30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038675, "uuid": "5b28cd25-2fec-48aa-9516-22db758d19ff", "value": "T1D5A69D03FC6119E9C1EDD1358A629252BB71BC895B3163D32BA0F3382F76BC4A979714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038675, "uuid": "60db1b6f-72fd-4133-98e1-069c7984091f", "value": "98304:shlUkTo7saRMWT5Ts6DKanoZhEPmJgomMaD9pucCTnKVC/69ouX9:s9TjaRM+99GiuJghpp3snKgSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038675, "uuid": "1ddaffd7-12d9-4bf3-bcd5-b45397f0912b", "value": 10083656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038675, "uuid": "3252d639-3ae4-4376-a77d-ae1f035f72c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038675, "uuid": "0ad8be7a-f3db-4b0f-a218-69631e794905", "value": "cnc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba5c6ed-d2b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765034057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034057, "uuid": "a863da2c-85d2-4dd3-a855-09540432b449", "comment": "Malware payload", "value": "aae6d212d20a125251de4c39e97467c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034057, "uuid": "79bf0e87-da00-4116-a8f5-42e4431e5e6d", "comment": "Malware payload", "value": "f81f2d7afec05da482f06ebcd8303a84c19a4349095b20e60a30d7b7635482da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034057, "uuid": "be7fa451-9e7b-42d4-8716-6221f295acdc", "comment": "Malware payload", "value": "f6e71e49667a87c2c7a38dd2989140ca9e6388bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765034057, "uuid": "bfe708f3-80a0-4d64-8eba-5a8b63bdd114", "comment": "Malware payload", "value": "3bb13476b13ca4a49f48ccc3fbe374ba80fe73f551fb1d3e64b1044eea054ef20d0285f0189e43ba7c729e19fcf8b9b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034057, "uuid": "636eb5df-0c2d-4dbd-9cc1-c888a342b640", "value": "T11414609679C9326FDC2F4A78035FEAB22A795CD07392496D4F80720D4C36A4A80EDDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034057, "uuid": "b02714d2-d1b9-4589-ae3e-3af6df7afa05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034057, "uuid": "a15300c5-7cd6-43f7-b43b-d07d0abccbdb", "value": "1536:Vpcy9rRCKod640skghjZqFsbheNqNOBkMP/S5ul7wl3FudqBKnosMbp28LHMfNbv:Vpcy91CKodMsvjhheNxP1BGQfNbc0Gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765034057, "uuid": "9ddd7a88-c173-4c41-a74a-d2454dd9de5e", "value": 207776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765034057, "uuid": "8bb220ee-10fd-44fa-a004-daf91cb65fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765034057, "uuid": "7187653e-118e-42c5-acc9-86fe11092b99", "value": "dfsvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30e188b-d2b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765035143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035143, "uuid": "ab8ac8c0-2393-43f5-9237-3ec0e18c0397", "comment": "Malware payload", "value": "c7dc9eef28a07a4934504c40b0f39e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035143, "uuid": "c236cafd-d6a8-44f8-96d5-1e1b53c80329", "comment": "Malware payload", "value": "f82642748a408a33da205c657ddc9bb41f720d09e19b22ca3165d347361ee99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035143, "uuid": "d703b910-a537-4dbc-9f17-f2ab13c8f11d", "comment": "Malware payload", "value": "540f8552a6ee8dc60ccda01fe535578547eb70b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765035143, "uuid": "5b5826b9-ba1c-4d72-a087-7e9feb92d48a", "comment": "Malware payload", "value": "c5a9500f970b83c62b8ecb3cae993db97cf7fd345e1825caabdd6ce9559637e9da5189d0f19fd4b53234d4b802dd7555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035143, "uuid": "be006406-889c-490d-9d00-ec8ebe856a9c", "value": "T12B94E732B4C8D5A4F187D8B21C15D996CE1379438FF2294B77CA7F5E072A0580EE369A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035143, "uuid": "de3bc9d5-3878-4afa-8151-0a5cc3015770", "value": "2ac29b9a5552466e33223f8c3f0a9886", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035143, "uuid": "fc54f83a-8a62-4d57-ad63-0e29b859c28b", "value": "6144:f16Zc7rYXqR4mdO3Dt4a6/ePsDj3B/GvU7ke3GVcx:f16cHrimWDt4pDj3B/PQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765035143, "uuid": "336cc32f-1b97-4d9e-9088-40f1d7b82e94", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765035143, "uuid": "c3e293fe-8eee-4672-bb2f-7a0f8c326b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765035143, "uuid": "80c1c272-3519-41fa-a14a-a723749e0cf0", "value": "5495.bin_1757427163.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1df2f3-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042163, "uuid": "d6a08949-4f41-437a-b387-7a02fe2bacc4", "comment": "Malware payload", "value": "4164a1945d8373255a5cb7e42f05c259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042163, "uuid": "ac771899-ec54-4b96-8742-7af73fffccba", "comment": "Malware payload", "value": "f8e7e73bf2b26635800a042e7890a35f7376508f288a1ced3d3e12b173c5cb7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042163, "uuid": "a494a98d-8f0b-4ecf-9e6c-0dc62d734ea5", "comment": "Malware payload", "value": "7c624e0b11c817d516f9411972191c4627fd2e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042163, "uuid": "c94c12ec-4c77-4d2b-bd6a-9ab577514ef9", "comment": "Malware payload", "value": "e4daf15dae8c02fa0ac5b12c0fe02e19d330c542a9a2f34f054aa0fe63a60181481b34e01679b124d251f74da4a55b7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042163, "uuid": "9016aeed-b0aa-4266-875e-902a03fa57c8", "value": "T1EC62070477E88368F17F8F39A8F342150A74F9669826EB9D2CC9125D1CA3789CE50F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042163, "uuid": "b1f96644-4188-4ea9-b34e-ba529fc42cb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042163, "uuid": "1d86faa4-3d0e-4f15-b17c-96b5638a7fee", "value": "384:XqSDzqfHGg/qayU4hpR9VZwFj3hNb4WK:XqSSfB/+hD9k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042163, "uuid": "be24130b-eedd-4ac8-a497-f24f398a41ff", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042163, "uuid": "846bdaa1-b5b5-4db9-ab8d-6eddcfcb896d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042163, "uuid": "d7eee23b-8cfd-4733-8bbd-3d20ebff8c76", "value": "agent_xworm_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a413b7-d26e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765003130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003130, "uuid": "05c46771-31c4-46d4-8fc0-8fd10946f72f", "comment": "Malware payload (Mirai)", "value": "83cd4084b10b2df6f9371c4b7c20a9e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003130, "uuid": "1d85efca-dd59-4e1d-bc15-fa89805d4488", "comment": "Malware payload (Mirai)", "value": "f98d91ffadc4795861747a25c41598bc8e835c86434a387afbf9f5559880c60e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003130, "uuid": "9d5d7fef-ce64-4d7f-bc1f-6529456fc2b1", "comment": "Malware payload (Mirai)", "value": "68c80c653b3fc8f30e27706c6266d83e1f9e44ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765003130, "uuid": "01fb8ba8-6dbe-4419-ac7e-fcb33d6dc98d", "comment": "Malware payload (Mirai)", "value": "306fd7b7676dd334966408e7fe17dbf06a7d378c9bf386fc5a78d4f199931d278a9342a411a91204359d14289a196dc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003130, "uuid": "97cd8fe4-2bb0-4900-80f9-e75277414a47", "value": "T1BEA34B0176280B87E6A319F02E3F27E287FADD8520F47548650FBB5696B1E321486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003130, "uuid": "fc1eb249-c5e1-4878-947a-3c905ad81807", "value": "1536:xaMaG5qq8aqpV4+vtiS8X6ehbQS74vQq3517Q3zRH82TrY:5asX8aI4+FiSIW7Eq2XY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765003130, "uuid": "688c5f1d-34c7-408b-a21b-f65ec4c18dc3", "value": 99024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765003130, "uuid": "966c1f99-e049-4929-954a-3438754a83f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765003130, "uuid": "c7c007c9-9f49-46e8-95ad-e28289de35c2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120fe7dd-d2c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765042148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042148, "uuid": "4e27b066-e394-4484-9800-fd36482eeca4", "comment": "Malware payload", "value": "1805079507fc5569c342de9c3c030577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042148, "uuid": "ee1ad8cb-9335-4cd2-8fd4-895f070f7db1", "comment": "Malware payload", "value": "fa49ec614d29893271b15b511a8c36dc3faf8499136cdda1fb8efc220b27491a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042148, "uuid": "fc2b7deb-42a6-46ad-bac2-1586015ea037", "comment": "Malware payload", "value": "78d9248a8baa3003beec0ad6ecfe810dbbdef114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765042148, "uuid": "b4574eeb-4851-4bc4-9535-cd8c42720fa6", "comment": "Malware payload", "value": "f8f480320a5d226ee85b93494f44bdc9bafaa7b8323d915744867feec2048e3482958a9895793013707149ad81ffa0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042148, "uuid": "105a3a45-d4ea-47e1-8f76-1d920956cfa9", "value": "T12BC6CF56E2F900E8D9BBC0B8C6575517EBB1345517309BEB52A48A692F33FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042148, "uuid": "c40a9ef7-c616-453e-bab6-212fdae3b0a5", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042148, "uuid": "19cdebc7-ac05-4ed1-bb46-413bad164e4c", "value": "196608:5Kx5ZkerI1dc9irWBGFGJ+fcIbm+rxbxOTg4NveIy:5KxapWfkUIbrxWgmGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765042148, "uuid": "1cffaf11-a307-4ab5-8bb5-8e85f84d6e63", "value": 11789062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765042148, "uuid": "46e4e84e-cf61-4d05-9c34-8d547e5964aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765042148, "uuid": "b0390ad1-7aa6-459a-9e69-487dca65f5b8", "value": "agent_dotnet_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80234bf-d2b5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765033917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033917, "uuid": "a55071b3-a759-4127-9ea3-cf67b63c317d", "comment": "Malware payload", "value": "c935eaa77a4e2a2176cf8c5b65c59289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033917, "uuid": "0dec9005-ae69-4b45-8407-a28bd2b46531", "comment": "Malware payload", "value": "fae6dc998bb8a42b608d9a01e8a8e1ce38cb922e36a232190f9491707026cd70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033917, "uuid": "3d0e47b6-b1ce-471c-935c-e9ab53ffe734", "comment": "Malware payload", "value": "4ceb9ba17e73bbac4f352d40574ca12129e732f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765033917, "uuid": "c06df6b5-e726-473a-a555-049574643572", "comment": "Malware payload", "value": "e8e3afb01c77af5257b827c138c7c1ef9cb291ef27b1bdefb77b67856b5f8aeaed027a1cbd81349a86f62f97d3ea5871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pttphddopp-oss-cn-hongkong-aliyuncs-com", "colour": "#400E39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033917, "uuid": "6bc1e879-7588-4acc-8ffb-d843c9c71816", "value": "T14794E732B4C8D5A4F187D8B21C15D996CE1379438FF2294B77CA7F5E072A0580EE369A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033917, "uuid": "c2c90bd3-eb40-4de6-b0b1-ac0e72c35244", "value": "2ac29b9a5552466e33223f8c3f0a9886", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033917, "uuid": "64cf8a31-6e8a-4bf2-a78a-6f61ab6c311d", "value": "6144:f16Zc7rYXqR4mdO3Dt4a6/ePsDj3B/GvU7ke3GVfx:f16cHrimWDt4pDj3B/PQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765033917, "uuid": "79be87e3-c64c-4414-bb64-d29df4ea0ebf", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765033917, "uuid": "a360ae4c-b31f-4c17-abb3-7de79baa12fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765033917, "uuid": "414b46ff-00da-439a-bc71-0af1dad2a3b1", "value": "tg.bin_1758442576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26af4e94-d2cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765043471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043471, "uuid": "9f77e57c-390a-4eb1-8cec-2a70632295d3", "comment": "Malware payload (Mirai)", "value": "4aa677a526e9ee552a3ebad7bc9c0386", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043471, "uuid": "090262ca-c11f-4b56-bcd7-18a1f4018302", "comment": "Malware payload (Mirai)", "value": "fafa43c38a5fb5cbbf3a90cb3542271bd6905796589bed3f93402d5df42d5259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043471, "uuid": "eeccfc65-5182-46f0-991f-346b08fa55a5", "comment": "Malware payload (Mirai)", "value": "b11fb7b004a313b3129af1136a808f006788f783", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765043471, "uuid": "868488b7-f129-4971-9e50-45daff9e034d", "comment": "Malware payload (Mirai)", "value": "4364510d649070398441338b6d94093d407fa66d448704887cb581914552a441cded057ac06089326969276a30ba261e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043471, "uuid": "c784f2d7-641c-4b19-9e30-13a89590fd82", "value": "T12082C030239A75F7E7F00435EAEAC39613B543B8C1E93371152162B8CE7625A92E2647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043471, "uuid": "5e0fedf3-af84-4407-bcb6-f256593c2eba", "value": "384:33zJ2ycgX2VF8l4sdV4dRE/Bxp9V9avIChKnH1dlhymdGUop5h4b:nd2TgGVF8lEda9VUvFh8Vfs3UozQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765043471, "uuid": "9fdd892d-8930-4c36-aea4-2f2f69c7770d", "value": 18032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765043471, "uuid": "72994e1a-3e8d-4aa0-9b04-a88f6ec95627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765043471, "uuid": "8a977f99-384a-4b1e-81b0-4088676b1899", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187dc43a-d2f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765061915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061915, "uuid": "ad7b4166-d10a-4794-8c19-1bf8bc007df0", "comment": "Malware payload (Mirai)", "value": "acd0059b722787a587a60711e4cf8c8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061915, "uuid": "5b42583f-9dbd-4e58-9a56-79a92a4b32c0", "comment": "Malware payload (Mirai)", "value": "fbad5a3c1bec021939fd5c477456bd337da11ccac30d75f58f2b3024b326acb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061915, "uuid": "57d09e59-5a0f-4eed-acaf-a33802b31f5e", "comment": "Malware payload (Mirai)", "value": "77d91016f373cc5bd9265f271abf92f5ee933781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765061915, "uuid": "0b4c4c63-bbea-48fc-bd3e-c0ed32781026", "comment": "Malware payload (Mirai)", "value": "e3ba6823ad1fb7ebef4b550919a2445a33e6cf49dbb48454565d02ad8a74d7ec191e306715411b63faf040f9abb22051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061915, "uuid": "4e21d5c1-0464-471d-b7b3-51bbc142690a", "value": "T153734B56B8815F21C5D5127BFA2E018E331317BCE3DE73229D24AF20378696B0E7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061915, "uuid": "414c9f1c-e1c7-40c7-9a3d-c492226b2270", "value": "1536:U+n6iFSvAp2Bv/zGt91anOmOFnzuMmiuLKoIT+K153YMy:1FSOtvanCgLKoIT+K1Vly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765061915, "uuid": "414918e0-c2a7-4053-87f8-27a5d475f043", "value": 75380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765061915, "uuid": "73a719a4-1b64-4a33-8de8-f5c09264ec9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765061915, "uuid": "9e0dd805-54ca-4c96-b1eb-af32e800179c", "value": "fent.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8449a95d-d26c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765002396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002396, "uuid": "dc91184d-a7ba-4923-8a5c-7833341ef7da", "comment": "Malware payload (Mirai)", "value": "6b1d85a02cbdd0b330b3171bc81127dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002396, "uuid": "ce16dd9b-9235-4909-aaa9-51cb4187acce", "comment": "Malware payload (Mirai)", "value": "fc0eb16de50f596922bda34340111fdcb898fa5df715dcfa0788cfa2e8ff4899", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002396, "uuid": "f1937e72-5d36-4240-b706-d2186734be04", "comment": "Malware payload (Mirai)", "value": "4ebfdb78d0c2f93969417045e57cd025026a8464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765002396, "uuid": "6c8915da-8655-4e25-801a-3233e281f214", "comment": "Malware payload (Mirai)", "value": "6582612eb3c68296bfdf0649c798de9f8fc3ecfd50f53f30e5022ac69be24858e35e49cdc2d6325ead0f1e332b654656", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002396, "uuid": "c1958afe-1c6d-4817-8abd-416e7a540344", "value": "T158C34B02B3280A47E4931EB0293F1BE157FEFAC122F4B684291EDB595672E335495F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002396, "uuid": "700ba99b-2bb5-4460-a352-8eefb4166115", "value": "1536:enbsyUz9WE1dPXqLnna3OeZW+kcmKP+UjnbBHsRnoQiUJZoR2jtbA5Up1ql:enXsdCnQOqW+RmeCRoQj22sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765002396, "uuid": "ff3ff7d8-2dd3-4304-a4f1-a2cf3b7217da", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765002396, "uuid": "4b2bbb4d-e068-49f7-aa3a-ce4bddd2018c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765002396, "uuid": "fa74dce9-3a46-4ff2-929f-96469511e3f8", "value": "colonna.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e990445-d275-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765006118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006118, "uuid": "c264971d-cfde-4a0d-96da-650ae52ff343", "comment": "Malware payload (Mirai)", "value": "4679172c009fab8778025bb90c95a89b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006118, "uuid": "531e36d2-eaba-4d99-99cb-7535f31297b5", "comment": "Malware payload (Mirai)", "value": "fd28c106b23419b7f3adee423e64cd6c8f7a0d27e048c55e4aa41a93c71119c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006118, "uuid": "95088ecd-c3ed-48e0-a93f-fb341eaa1b1b", "comment": "Malware payload (Mirai)", "value": "d9958cff61c815708a006bb7c8165cbc2462240c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765006118, "uuid": "00c6ccf9-8df0-4de1-b31a-63b043991d0b", "comment": "Malware payload (Mirai)", "value": "269af89b1be0884e8d3a84b2726d36fa00a4d4cf4e8622e477d0b8ffb2dc381c15f3f11ce80cd59c1fc251d4ba245b83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006118, "uuid": "f3ef1563-ba52-4774-b789-ad3d99da029e", "value": "T1DAA3098A7C415A66C9D423BEFD2E018D33132FB8E2DE32169D156F6077CA91B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006118, "uuid": "5a8b08b9-d129-4f53-b23d-9b4ce5c9ffc7", "value": "1536:oPnacby00gGFs+GyGgzs8FakVpauKwHxOgpMMxJCCwmXRgCKFNenYLgrq+wOv+BZ:8byZJ2lUFROHM6t6gd2oWBepGhmpUoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765006118, "uuid": "81fc3d20-6245-4218-8e3e-b6dd30fb1d70", "value": 103136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765006118, "uuid": "eefbe655-254b-4acc-97c7-5e52f5ecbae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765006118, "uuid": "824d28df-db99-4509-9ff5-473c854766b4", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6355a00-d2c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765038665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038665, "uuid": "52f1ca42-e5cd-4b38-be27-461da94c09ca", "comment": "Malware payload (Mirai)", "value": "359c5d9815fda75cab6b8a8dce0a5158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038665, "uuid": "8dd23da6-ee1d-404f-8aaa-7ba4b0b8427b", "comment": "Malware payload (Mirai)", "value": "fee374270baa5a9af502ebdd192df3dbe02dda68a46f82e8f8424d02c9f40304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038665, "uuid": "92c75514-3a04-46b6-b51a-552c5df728d5", "comment": "Malware payload (Mirai)", "value": "0a214a6259fc2583d8fc4b3f5966d6cd385efdff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765038665, "uuid": "68187c32-8b86-4f50-a240-794f786dd398", "comment": "Malware payload (Mirai)", "value": "08c23fd2fd7351578843ee42e045ec126d3201881655914d4bde89b9ada2a66c8d9dfb61f63425fa28debd41efd23acd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038665, "uuid": "f824272c-da32-4948-b2ce-a3d792dcdd96", "value": "T129A3198A78415A26C9D023BEFD2E018D33232FB8E2DE3216DD156F1077DA95B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038665, "uuid": "a4200fef-a60a-4352-b8ca-d7cd1135b054", "value": "1536:8XnIF7+r4kEC+81CIORj/haqOu0N65wFgLm0xOZg1Zo2OPhCg1KY1yGnMOE0YAc3:zOFfE7HmFKqgfOZdfYrkCWhxwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765038665, "uuid": "a6eb0d2e-6a60-4087-8228-e8a0e92a9a4e", "value": 99036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765038665, "uuid": "f1eaaa2c-f36b-4080-80df-dc46be62a229", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765038665, "uuid": "a30b5417-ba9f-4067-a4ca-c8814d1291ba", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6e405a-d2be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765037660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037660, "uuid": "2111f1fa-1387-482a-9a57-5c606086d9d1", "comment": "Malware payload", "value": "497caed51689e3b12111dbedffea237f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037660, "uuid": "116f22bd-6d20-41e5-bf1d-5d5e9c9a0bfe", "comment": "Malware payload", "value": "ff68931f360dbe32ac29c73bb4154cf6a7a5628ea8e586cbf5f259c6f0ccc480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037660, "uuid": "6cbff920-7186-49ea-8d2e-4ab7d6552a61", "comment": "Malware payload", "value": "af4b619eaa80e6cc005255d19f75cd41b18f8ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765037660, "uuid": "879849d3-a24a-4bac-b672-4c4927f01375", "comment": "Malware payload", "value": "b1b7366dc9959fe52124c692aa4c68bf3ab693fc3c1f249a0a8a77c5e70b9fde6672397784745a5d62b0ce269926cb68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037660, "uuid": "6072e2e1-6336-45b4-92f2-c709dad31004", "value": "T118163B19E78385F6D92305F15507EBBFAA205B358020CC6FF28CDE98EBB2D926519317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037660, "uuid": "af7e8377-ada9-42cd-9c3f-31838d6924e5", "value": "fe72a6f9785b2ba00165f2881de4c777", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037660, "uuid": "ee7ce8e6-cc5a-42d4-86b2-97f1a83418c0", "value": "98304:XYSGGLYCuY+1i92Eav4WvrpWuusctAyp5YGJN:X1dLYCuJ54WvrpFu7trYGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765037660, "uuid": "fb0cacb8-519a-4851-9399-49fc017a4655", "value": 4033536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765037660, "uuid": "1aac3953-bb57-4ed2-9383-d981cb1bb9ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765037660, "uuid": "ee7b6080-65d7-4c3a-ad71-3ddc4e5cd437", "value": "aria2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9316af87-d290-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765017883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017883, "uuid": "6b96fa44-9902-44c9-8e6c-4ff3e4ebff7e", "comment": "Malware payload (AgentTesla)", "value": "55c2b1a4cc381eba230b650950f780b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017883, "uuid": "332a89af-f1c4-4c9f-a7f1-8e06d9860dfb", "comment": "Malware payload (AgentTesla)", "value": "ffc7f46592ffd3489bf099ceb85789ddcb8a58e7e1623b377b824736e5c1e3fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017883, "uuid": "43b3a816-a288-448f-b10a-278e8861c8fb", "comment": "Malware payload (AgentTesla)", "value": "c97af2861564b65911b26c44e409e89d92981b33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765017883, "uuid": "081df436-46fa-47cc-88f3-649054ddefc6", "comment": "Malware payload (AgentTesla)", "value": "53eaecc645634b730e78fbc57de8eaef511046c7065dce782c5964dd86aae585536a6229b03c73d6a0537e7e420af8c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017883, "uuid": "ed175ede-476f-4732-be82-985c581ce506", "value": "T14AE423AE49CF46C610DD50E3F5D31AC0B63753B704A9D3A5ABA0DC4D0F7885AF269391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017883, "uuid": "a1c9ed51-ffe0-4fc5-b0c7-56286f9cca2b", "value": "12288:DRSH5nH769I5J+PgZMPjc1UoWBvH6xlPmM8G5kEiKzfyR:DgH5H7v5J3Sjc1yBaHPmM8G5kEiQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765017883, "uuid": "efb04b51-e92e-4c55-bcfa-cb1ed96d700a", "value": 678435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765017883, "uuid": "510ba3a4-8089-4450-a0ea-83cd16c39ed4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765017883, "uuid": "4ae77e45-f206-4e97-a604-3aa124355635", "value": "CGDD016760 Guoxiang - Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }