{ "Event": { "published": true, "date": "2025-12-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-16", "timestamp": 1765929781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "caef1815-aab5-4dfa-816a-262c76a79ffe", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8f5e62-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879602, "uuid": "ff5b1008-c11a-48ca-9720-e661b57b5161", "comment": "Malware payload (Rhadamanthys)", "value": "f78cedae88e1a72f4f0993835d469c68", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879602, "uuid": "6e9b4f10-3220-4240-ac8f-21f0791e2a77", "comment": "Malware payload (Rhadamanthys)", "value": "005ee6be81e67073e4b3967487c3962621dfd199411c11b92b1cccc67a42a7ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879602, "uuid": "e70a3b93-7a7a-4dee-b1ed-f425aa22f690", "comment": "Malware payload (Rhadamanthys)", "value": "8d954123fe66f58c75e094659f5461aa5eb8e424", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879602, "uuid": "74afe1d0-ea9b-42e1-9e82-e2b446473223", "comment": "Malware payload (Rhadamanthys)", "value": "4981d3fd9dc7e0faca12613e8e9e53c0313171ece60cd586e22db43882f4c2d8ec01f78b567a87e8cd8e78b9f603b5ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879602, "uuid": "43397489-8875-486c-9970-fd1d080dc081", "value": "T101A30B46DB3A9A6C01C37EA6F80B5CAC456D07DC5C0ED090E589FB82907CB7A5A717CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879602, "uuid": "4fb414c6-9cdf-480c-b362-fc4be0ddf12f", "value": "1536:GDB7eKg209mkg7pLruaCz0um5iw8xNsZcaoAYkxmjqyXvop1+S/A3/LWULixLACA:GDB7b08VeABD8S6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879602, "uuid": "cd9a4700-fe15-47cf-8598-fb93bf6a352c", "value": 100126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879602, "uuid": "ffcd3d0b-01a5-4b0b-b1cb-208d9a03f604", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879602, "uuid": "5d408aba-7f3a-4f55-9a0f-632871ab4635", "value": "invoice-1637482117.pdf (70).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2c2dbc-da5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765874905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874905, "uuid": "63d07736-faf0-4220-8669-a4b4ea52e9ef", "comment": "Malware payload", "value": "6ea297cdbfb445cfc3ab950a0d02c119", "object_relation": "md5", "Tag": [ { "name": "207-180-229-201", "colour": "#396A90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874905, "uuid": "b44506ad-61d9-4b8f-9825-3ff5590e30c1", "comment": "Malware payload", "value": "00d7f7fce508b0a066421225f143a876707262781e7462b54f1652a929b25d5e", "object_relation": "sha256", "Tag": [ { "name": "207-180-229-201", "colour": "#396A90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874905, "uuid": "d94943a0-a548-420d-ab26-300ab8ad72e7", "comment": "Malware payload", "value": "33ca19ce26afa43924428d4b7c2d2b012d16ec29", "object_relation": "sha1", "Tag": [ { "name": "207-180-229-201", "colour": "#396A90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874905, "uuid": "59350169-9ca8-4fda-a73e-93facc8c69cd", "comment": "Malware payload", "value": "8d175feba241c7466d6c5d5fda93136aa3d3a88d9f15f931fefadc3188666e8f68c18c576bc4ac843b72e9abece56891", "object_relation": "sha3-384", "Tag": [ { "name": "207-180-229-201", "colour": "#396A90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874905, "uuid": "c86de4b2-2469-42ef-a12c-78d8094fd40b", "value": "T1F6E63385A1A008F9E6F6823DDB528A37F733FC61072495EB376852521FA7282CD3C759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874905, "uuid": "ef8b3019-4681-4ba3-8e2c-8db80ef75148", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874905, "uuid": "ba237ec4-2b1f-4944-a418-0910db7a17cf", "value": "393216:Ra4STXwq3Obs2Clt1W+eGQRCMTozGxu8C0ibfM5Ztki5:R3S7wq3ObRqt1W+e5RLoztZ0z5nki5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765874905, "uuid": "34c695f9-335d-49a0-ac1d-1e35cb6f6670", "value": 15179834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765874905, "uuid": "cbf40b65-4329-4679-a7d7-85de82a10e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874905, "uuid": "6b88d535-5024-4935-9098-214538ade866", "value": "00d7f7fce508b0a066421225f143a876707262781e7462b54f1652a929b25d5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59c7f9d-da61-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765877471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877471, "uuid": "52b33185-0b53-42cd-ab24-7ab0e779c9b0", "comment": "Malware payload", "value": "5d16a2f2901bb32ae1f82ac939b05813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877471, "uuid": "2194882a-fd57-4af1-881f-245e9725ed49", "comment": "Malware payload", "value": "015deae2198df08e4887073a99dca36bc3bb2ac37fa7ff0ddb105b4f626fe05a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877471, "uuid": "020cca29-00d5-45a6-afe7-1569cd488c48", "comment": "Malware payload", "value": "54993b297ce4325e06d070ea4fc002ec43d5fba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877471, "uuid": "fd8bf5d3-b523-45b4-b527-971fc9d01781", "comment": "Malware payload", "value": "863bb09bb147c0610c83d4922a303a20cd46f83c94c349c2a66184738469b38731d8f8f0a013c600bb8a5af6d2ba20c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877471, "uuid": "930bb2e2-ff72-4b61-92e9-d7ad0c4d6936", "value": "T1A1236E41D64340F2F06765F058DBE7BF8932BA338D70D939EBA4C909FA76AC4560631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877471, "uuid": "dc52397a-cc57-4bcc-bb4e-4d24df6d21ea", "value": "cc27ddf9d33a92ce95db44c7c27ec5ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877471, "uuid": "c1b0a1c3-dafd-4f4e-8012-fc28c478e69a", "value": "768:jjqpc7o+lfUnIfS8OB+b6yLUHj/VPd4Fe3GELUpeWmc:Xqe8+GIfFOB+Grtdse3CpeWmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765877471, "uuid": "f1b7f9f1-7928-47c3-9023-6bae4d57e70c", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765877471, "uuid": "06e6df0e-5406-46d5-948b-b07e799b0baf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877471, "uuid": "3a9b9991-d910-4f0c-ad47-6d8a1005e18d", "value": "z2EnterprisesList.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0353713c-da7d-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765889091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889091, "uuid": "86203e2c-5f0c-4f88-a374-57a58bf8f21c", "comment": "Malware payload (RemcosRAT)", "value": "2b1dd0aa0109febe9508901c27717982", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889091, "uuid": "456789be-dd54-4cad-902f-09e392b76cbb", "comment": "Malware payload (RemcosRAT)", "value": "02674128e433257567694f6581efafdb79d65c062e6afc094bc8350a69cd58fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889091, "uuid": "4256ffe8-eb98-4eb7-903a-f9da9272b6e6", "comment": "Malware payload (RemcosRAT)", "value": "a51702f1cb33463b8510d082c6148de7c2501563", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889091, "uuid": "ee1629dc-a5d4-4d17-aeec-f40026f93fe7", "comment": "Malware payload (RemcosRAT)", "value": "6fdcc9c4d9dbb6c089cad9fb05c608126017f91fd49698423e705c1f7c84735a18517d13d204a86a00a0abca8367e6dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889091, "uuid": "b656e77f-e702-46e7-9edd-80f6fd13634b", "value": "T10D536B60CC2919B70F53BBDCBE698620C9ED8329452654F0F5DE870D910A9ECF73929B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889091, "uuid": "5618c74a-b392-4dcd-9095-63100ff29c56", "value": "1536:kJz1xQ2CB1tJK+Vb04TWEcW2E7mj8uvgKqo8k5x1X3:0fQbBTJK+Vb04TbclE6ck57X3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889091, "uuid": "8feafb9c-55c9-4e1d-8a86-26111cdcb89e", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889091, "uuid": "58423b68-074d-401b-8045-ce2ab3b43cf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889091, "uuid": "52861405-fab9-41b3-bc3e-145314223477", "value": "Bestellung 262107646552.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bf641a-da1a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765846838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846838, "uuid": "e577dd0f-4347-48c1-ac1e-1abe1ec92962", "comment": "Malware payload (Mirai)", "value": "66d739aadbfffae6eb8b4b77f167d26b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846838, "uuid": "5fa85fae-4a89-4d77-8c8a-a1137fe7cbf2", "comment": "Malware payload (Mirai)", "value": "028fa29429697946922fb784bcfafac38e2f117feee6d3f6f255bec88192bd96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846838, "uuid": "a6ad6e27-32bf-4af2-bfa8-ed8cd1e8aade", "comment": "Malware payload (Mirai)", "value": "544ddab4f992bd1802b21d8f7cad875a2a7a9cf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846838, "uuid": "f6173275-1485-4a19-9c86-a74a724de39c", "comment": "Malware payload (Mirai)", "value": "938437b8343e004f66c355788637c41659ce31a3ed7f09a54cacd2b589b1941a2151059a80ec1d596869ec29c8eb92ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846838, "uuid": "21e66787-2f8c-4f9f-bff7-c307016436c6", "value": "T181E3775D2F338FADF678873447B74A25976823D922E1D684D2ACC2105F2039E645FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846838, "uuid": "c233e025-b572-4f76-90db-263b5258b92b", "value": "1536:Ik2h+5qw8mNnJ9Eo/DC9l0Wxgtcv6mU/tFlkT/daYezctz0reU5v67psS:Pq+ImNz2/0Watcv6mu6ozctz0t67p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846838, "uuid": "73b648c7-e804-4b60-87f2-f1bbe596675f", "value": 145664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846838, "uuid": "1feaaea1-64bd-4c04-b85d-0c3239a32e71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846838, "uuid": "dfbc2255-2eff-457c-a027-936176ec3dd0", "value": "nuklear.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc06131-dad3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926286, "uuid": "49ed78ac-02aa-4edf-b4b8-5398b7c3cec6", "comment": "Malware payload (Mirai)", "value": "bc7e8f009c35e448c97cc9d9b1b98725", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926286, "uuid": "a9ce2090-1b87-44d3-bd21-47c770b13ebf", "comment": "Malware payload (Mirai)", "value": "02e91a07cbfba4ea63b8464ca5fc0934bacdb20a42e4e3ff9a49c3c67464b097", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926286, "uuid": "6c649525-7b66-4717-9265-6eba56fb4502", "comment": "Malware payload (Mirai)", "value": "f4452da2551f1620c5f8647706ac3edddfcbe363", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926286, "uuid": "6763a805-4bc0-4dd5-82d4-af3aaf955b9d", "comment": "Malware payload (Mirai)", "value": "d17e8193ce4845a5c4218bbdc9c4fd5d4b09bedb782cd68a556673229d81d3cd4f0cace10e6826b4c7809d14040644b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926286, "uuid": "567e7f4c-c284-4a23-8959-7b324d0d41a0", "value": "T102B3F70BAB60ADF7D89BCD3308A9874634CCE5176054373A3A34D52D7A5B94F4AE38E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926286, "uuid": "cd6b448c-c92b-4b80-9fe1-cb460c52fc1d", "value": "1536:XFfJ2PvxEpMD11pgQqVyRY7pgapWK11N9GsPgt+5lBgTBhUMjb:XFf4PvuMtRuYClBgTBhBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926286, "uuid": "30e41a12-1823-44a9-9121-477badcc59fb", "value": 112463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926286, "uuid": "1669b39b-5b86-4589-8f5b-7ac78d47d95e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926286, "uuid": "0b943bb0-bcb2-433b-89ba-1ce17e6949e8", "value": "n3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47a7ebc-da86-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765893361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893361, "uuid": "389e91e6-1be1-42f1-9137-511d5ea5d319", "comment": "Malware payload (Mirai)", "value": "8d9d24cc76e8f74a5c35ad53579c373c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893361, "uuid": "8b9c605f-556b-4dae-ad51-61c2d374a157", "comment": "Malware payload (Mirai)", "value": "0321f786c082811a5d207aba65d8fec696fcb2226761ebfa65409e876cff906e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893361, "uuid": "03e66b62-a95c-4279-8fef-588347917348", "comment": "Malware payload (Mirai)", "value": "0e8aeb8dcb9a53124a3c507a1b8f120a7887a2f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893361, "uuid": "8b602056-0e8b-4b10-8331-35e3a780c613", "comment": "Malware payload (Mirai)", "value": "933ff446c96771907020a918c4625298a6af0dea2ce4447e64664d99352c871e50829546cc23f2bf4a2b45c14527a082", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893361, "uuid": "b01a00f7-83a9-4e71-87c6-1aae726b6980", "value": "T11EB32987B7284343E5524AB66E3E37E88FACBD6051BCBB4C241B670D4176C764846ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893361, "uuid": "8d754170-f343-4203-a787-d8f4003686ac", "value": "1536:D2rMccAIBqwciiM4cLnIOkmyKB8dsZfGDwa97q8nTo5h:cUiuLfk6isZX/8n85h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765893361, "uuid": "dddcdc08-bb6a-4fcd-9345-a9846b572a94", "value": 117764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765893361, "uuid": "202f7639-3dfe-4b1a-a9a3-e93c6806b5c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893361, "uuid": "52cc1302-0ee2-4002-a8db-29c43a32999c", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591bbe3e-dad1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765925312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925312, "uuid": "fff27d3e-0cf6-471d-9695-a03612023dbd", "comment": "Malware payload (Mirai)", "value": "7f86a7fc702a05ae57460a5baea9ff5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925312, "uuid": "d7e8aeb2-299e-4ffa-82e9-1b907778fe15", "comment": "Malware payload (Mirai)", "value": "0352a3833d99ea1af33cbec2f8d03526d441e1f156f46c3e35f68079418ac2f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925312, "uuid": "ac1b1580-522c-40a2-adc1-bc7b9a202c41", "comment": "Malware payload (Mirai)", "value": "1e6c7d3176f0bd51cf2c177e1dd01ffbc5b315c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925312, "uuid": "25190962-59ad-4957-a54d-3dbd46450e40", "comment": "Malware payload (Mirai)", "value": "46649542a53bb16ae979e6e5f31261b3c83185a9ceb148e3bf5e6804e6b049abcd9a01059b03fcd2d90517a1c9b8047e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765925312, "uuid": "33ec6e88-8734-4de0-b216-70090f722046", "value": "T172E3E649AC818F61C9D7A3BBFE6F518C331207A8D3FA71169C1C5B55738B42B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765925312, "uuid": "858eea20-9467-4ce5-9ba5-a45f0cf22eec", "value": "3072:lv6CW+FLQmvC4GZhV+cUmpADOEw6lfEDnZFVnKz5:lv6F+F8mvCDVtUmpADON6lfInH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765925312, "uuid": "4e0b4cbc-cc9a-45bd-8f35-243717c6b266", "value": 145060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765925312, "uuid": "336a8505-aa54-4358-a039-22745d1810fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765925312, "uuid": "2ceef460-5073-4dd6-a995-d504d846cc1d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcadb87-dab2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765911975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911975, "uuid": "2dfd9e9c-e6ac-4969-84ce-2fd3f2a0c109", "comment": "Malware payload (Mirai)", "value": "804073a43520dc6c9cf8004bc3731c49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911975, "uuid": "f8e70184-df79-4dcb-adb9-eb1821f88a68", "comment": "Malware payload (Mirai)", "value": "03c5d52090b1175beda399029d473aeb503b3207ec3255f7aaa69e20e5bbbf2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911975, "uuid": "1767f0b3-e4ff-44e9-af9c-2d4fd38a196c", "comment": "Malware payload (Mirai)", "value": "70d4753c42a65afaae864fe89b2e5486bf46281b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911975, "uuid": "7fec8d97-54ba-4c7c-bedd-b39c5e824408", "comment": "Malware payload (Mirai)", "value": "51efeba3bbd4b8c17d66c3f37ab056597576926f86f1747b3ead66cf60f273cfe280a6f80c758633f2ce3c3ce2ca551a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911975, "uuid": "292b4560-3316-4d93-98a9-a1c389681c9e", "value": "T1A9C32A86B32C8347E0428FF56E3E37E4CFAD696060A4B78D241BA60E1176D764446FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911975, "uuid": "52906ff2-7135-4668-84ba-9486fe6060da", "value": "1536:KEL0GQIzkfP75cBIgmfhd3fYSOmsT5QCPJivi78nXhVR15Yy9gG:c575cnmfh1Ls2Cv8nXz5Yy9gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765911975, "uuid": "b63e5698-782b-40f0-b73a-99e68e161a64", "value": 121044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765911975, "uuid": "d3a7452e-0bcd-4c8c-9657-d71d77df0cd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911975, "uuid": "7f1f0fcf-d032-4eab-8c4e-1e94ba0aa6f9", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1107ee3-da7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765889489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889489, "uuid": "bbcbcfb4-4d4f-4c33-bc86-d9a7df9aaeb6", "comment": "Malware payload (Mirai)", "value": "03ff37bbb06265bebfed40f36074c9a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889489, "uuid": "74ef5f8e-e432-4bea-89f6-f4d9dc8b8dba", "comment": "Malware payload (Mirai)", "value": "0465e2ca52d0c9666efef72db9ec0ef03e6359e3e611338f21942dea7ecdae96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889489, "uuid": "1863fd4b-d237-4e02-80be-10d2af9d6a6f", "comment": "Malware payload (Mirai)", "value": "91db939bb67286bc7f1b02154bca9bf489623e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889489, "uuid": "8d183cd9-bbf3-48f6-95af-28c3723938a7", "comment": "Malware payload (Mirai)", "value": "ea4222a68f7e41b600c06dc28b6ce4037dcc5f078f9439b81fc4d4015141ae195a66d701b8d971aff47af0706cecfa3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889489, "uuid": "c46876fd-1587-4f0a-89b4-a1f372266a54", "value": "T17A9319C27005CE7CF80F967686BB8619AB74F5554F410E37F5DAACA3AE3A0843829DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889489, "uuid": "b7f41896-7ac2-4d2f-a360-9634832d5dbd", "value": "1536:VEhqZQcEU+l3EUF2uDGE3LPpsq8uuKZCJk0GSa6qcJtM7GML1555MWpW8qSloXTj:VEoQT8UF2ujLhcFk596qcLM7GMB555MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889489, "uuid": "245586fe-33e7-4cf8-8cf4-23840cb5d64b", "value": 95252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889489, "uuid": "5c8066d4-035a-421c-9940-ecaaaaf13167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889489, "uuid": "44e10e5a-a745-455b-816c-37fca7a116d3", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457d4f4a-da95-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1765899509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899509, "uuid": "7c636147-234d-4ac9-8357-ad6d96f2f4d6", "comment": "Malware payload (EternalRocks)", "value": "49605489b4e40353b12192422e06a098", "object_relation": "md5", "Tag": [ { "name": "144-124-241-181", "colour": "#A390FA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899509, "uuid": "f4ac9342-420b-4733-afc8-d206ab9b68b2", "comment": "Malware payload (EternalRocks)", "value": "04ced453d7e0681c6da073ddc5172c8976885af3afd3be8abb46008ea0a08dbf", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-181", "colour": "#A390FA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899509, "uuid": "b178cb03-e6a9-404b-9b41-aaa45d467828", "comment": "Malware payload (EternalRocks)", "value": "d4c7c583c9423ee4ec932897ee935d194b5b8238", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-181", "colour": "#A390FA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899509, "uuid": "bd29aea8-2057-41db-8fca-1017edc985ef", "comment": "Malware payload (EternalRocks)", "value": "8ba89a8c894d083602c59b9e6e88470eddfed2952f17cfe9f183b7a88bbf77df3443c05aead12cf27344140a2ab620ff", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-181", "colour": "#A390FA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899509, "uuid": "bb1d8f1f-55f6-490f-a69b-f7af12605c1a", "value": "T168A65A10A4C86607FD7ADFBC999E76540F7AB1952501BB28CF5249DA3ED1B68C8038F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899509, "uuid": "2bc7d500-9da1-4140-b54d-afd86cca327f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899509, "uuid": "0f947ac0-9559-4c4f-a623-0730b351409c", "value": "196608:mvBzJxW0KhTwcOvgWu3VWVUPMwCFZuU26yLmp:GW0KhEc+6FWV7dFZ1dCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765899509, "uuid": "31c6cb66-d011-4720-876d-a6549fdf3861", "value": 10100736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765899509, "uuid": "8945d93b-85b3-41da-84d9-49fd49a2d064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899509, "uuid": "8c47ef9d-dc1d-4510-9d4f-959d09307dfb", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff60fe59-da75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886077, "uuid": "c0a5cb63-99ef-4257-a00e-d5ba85b7df59", "comment": "Malware payload (Mirai)", "value": "f4617ab12fc5ab665f4eca8361445a1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886077, "uuid": "3dbee89c-4526-460b-83b6-95243dd3eb58", "comment": "Malware payload (Mirai)", "value": "051abc668b45664605e547750d363fd55b62275c73ead4252a2ce671862c18a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886077, "uuid": "bd9e2c91-4257-4c03-8b53-8f934559bfd7", "comment": "Malware payload (Mirai)", "value": "f73880516d527237f40407b43d6529355ee8e207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886077, "uuid": "6b541acd-aa4d-4c8e-a657-59dd78d831f7", "comment": "Malware payload (Mirai)", "value": "24a773f5741ceee4212ec2882e62b5b7155c32a8c20ea7cb449dd4cd0a1bc51a8d41a99b40c26585445ee4e24ef31d1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886077, "uuid": "1791ed66-fe8e-4a6e-851f-022e9f69b8b7", "value": "T167C3D7956C418B25CAD323BBFF5F118C332213A8E3DEB11B9D146B55778A2270E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886077, "uuid": "d7110880-8be3-4645-861e-44b2f504c388", "value": "3072:sOh0T8pAZ7HSHcFnO5aJltIb3ao8WE5Vnr5l9vq:sOhO8ps7HSEOwbtIjadB5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886077, "uuid": "2c92dcd7-6d0c-4336-b8fe-610d2d4be453", "value": 128884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886077, "uuid": "42b96844-9785-422e-aab3-d8691b8060ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886077, "uuid": "c93ee595-35a6-4c1b-839d-cd160549e21e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff1ca4d-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916412, "uuid": "5dd691ea-2e81-4f08-a15a-2de404a465d1", "comment": "Malware payload (Mirai)", "value": "c23dde45b987f6ef5ac82abd8ecc3b58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916412, "uuid": "b52f4f88-93e3-4817-ac4c-f96f9faeac11", "comment": "Malware payload (Mirai)", "value": "05e5d98dcd65c53368232267325f6fa94386cfcd1981bd9dc30242562229fd59", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916412, "uuid": "cafa804f-62c8-43f4-bb55-2acfecd0101c", "comment": "Malware payload (Mirai)", "value": "6bc5fea6363d2f9ece7028c67fbf137c59f9662d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916412, "uuid": "a0f5671d-eaef-433b-83f9-cf6dbd9eba80", "comment": "Malware payload (Mirai)", "value": "a9540032c9c2a110db4568d8d8fcd4ae2dd367741d6b0ef106d1a6134afb579ea947014bdbe64cca4d67d78c4e82870a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916412, "uuid": "0149f044-be10-4625-a0ec-23053b2fa8e0", "value": "T1837170CA1125B7796E66C72233F641DA72E0C1E9E1C38E4760C838F7684CD4764A1EEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916412, "uuid": "3d306942-f4c6-48c2-b231-49174b44f44a", "value": "12:q0FgNGd0FgMGkp+0FgMiGM4qO0FgwIGwDF80FgwxLGwxEqi0FgwhiGwhhq0Fgw72:vsrJ7IHQP39uthFB/+bbnqc7Xzxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916412, "uuid": "22dd396d-2ebb-4931-85f4-3def47673fd5", "value": 3488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916412, "uuid": "13d6c245-0639-475e-8b08-5c310e97bd33", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916412, "uuid": "0812f5ce-ccee-4e76-974e-38838d5e475a", "value": "Fantazy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6049b2-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765852783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852783, "uuid": "a981a257-e903-45bf-b888-3b28c44b243d", "comment": "Malware payload (Gafgyt)", "value": "f383af4319445a3adea2b9b75111e14c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852783, "uuid": "33fd5b8a-3cf2-429b-ad05-a1efa9461800", "comment": "Malware payload (Gafgyt)", "value": "06195b5f16386d49fda0637dd82f1d4181419b1167d090589cbbb61b44248f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852783, "uuid": "e1b5afb2-3c93-41d2-a9af-190e03da49ec", "comment": "Malware payload (Gafgyt)", "value": "d255c0ee692d27f7a8cfd274719786b93bf5bfa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852783, "uuid": "63fc204a-05af-4174-b3c9-f08b297d771c", "comment": "Malware payload (Gafgyt)", "value": "07c814efcc5cf1d2aced28c522ef39ee0472e54c6aeca29cab245ac84b9ee986767d039576814e9e9301f4b45afb7b37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852783, "uuid": "6a32b3de-80b8-4751-bd16-e3f6fff499c3", "value": "T1D5C3B61ABB619EB7CC5FCE33059A4901208DE58612E96F2FB2B4D56CE74B94F08E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852783, "uuid": "27182ced-4514-46d4-988a-3fe716ce0ce5", "value": "1536:BfKneTGp19FFM4Yv3ZyBEaoLqUgx8Auau00pUX1BErZ6rmthjF71Dj+1MdI:BfKFve3Gxx3u00SnrmthjF71Dq1MdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852783, "uuid": "dbb34342-89e6-44e4-a756-b1fca2262008", "value": 126387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852783, "uuid": "227212f2-15e4-4925-b26d-86c1ba422e53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852783, "uuid": "49ff3ab2-a560-468e-93c1-94fcd4229425", "value": "Fantazy.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766e1dd6-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765852776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852776, "uuid": "f676f69c-1405-47c2-ac4a-ec38d2fd5c16", "comment": "Malware payload (Mirai)", "value": "b5af08c7918bddbc8c1a36f607d2ca42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852776, "uuid": "ccf6a328-0cd4-4de5-9407-63e72808b4e3", "comment": "Malware payload (Mirai)", "value": "066ee6f2d1513d6b93695e6750a4734c87a3916287cac14cad315c0c239950ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852776, "uuid": "34517947-89ef-4c48-ac9c-dc090b3fa28e", "comment": "Malware payload (Mirai)", "value": "d92e570c9510fe2cf903b494f7844a31d515b91f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852776, "uuid": "8e791aad-6570-4425-b9b9-2eeb45158472", "comment": "Malware payload (Mirai)", "value": "4123334fedd8c5dac9e4c93c99331122b24fbb23ade06dbbb0db90309a4ac5c832cfa1b68e48ea170ec031c9bcd844ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852776, "uuid": "729d42f5-15ba-4ce5-b5d7-cda0b07242a7", "value": "T14C833A82B781CAB3D48316B506DB9B110932F9FA1B0AEE16F36D2DF48E150C47A52F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852776, "uuid": "3101e87d-2795-4e43-ae67-fe3ec13c3ba7", "value": "1536:7Hs4Qzg1Zr5hcIAx8QgBNzQZ8Stx0KXP/vUa2md+bVYz+UEcf/31:7HPignr5hRAxLg5etxTfImMbVYz+Pcft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852776, "uuid": "36f44a3d-a547-4387-9022-16ff714330de", "value": 82407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852776, "uuid": "4df7a858-b4c5-4476-8b92-6540c7c19ecb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852776, "uuid": "4229aacf-7c8c-4bab-951b-6a3ce7d78e7a", "value": "Fantazy.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2740ee4-da4e-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1765869305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869305, "uuid": "3e421ba3-661c-42b9-9fb8-bfb8420f1530", "comment": "Malware payload (CobaltStrike)", "value": "f267cc848b3dcf097ba82558417f84c9", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869305, "uuid": "550e8c34-f0c5-4d0a-ab8d-d2afc49beed2", "comment": "Malware payload (CobaltStrike)", "value": "072410494ccf5227297dcc0cdbff5ce815709177d74e9b3681ea226c9d3d1cfc", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869305, "uuid": "a174b67b-c471-438f-a125-702cc8affa09", "comment": "Malware payload (CobaltStrike)", "value": "8cd5176b28c3b3851b187882b3a853ca249d3051", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869305, "uuid": "10f2acc9-ec63-4fc2-85ec-9c541098638c", "comment": "Malware payload (CobaltStrike)", "value": "03c49b042fee89b347d8bc6e2c8c49da104d6a41f39b2969ee8fe068abfcec9a2d67a93a21fd627d2effacdfc80166f6", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869305, "uuid": "a9bba366-b53d-48a9-92cf-384adc745336", "value": "T1D923C74DF652046CFBD6C436D8AB66B2E5F1B802C355DA2EC254CF323FE05905EEA50A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869305, "uuid": "3e0c1334-51cd-4d67-a928-444c542527fe", "value": "68b9e7ee2fb33bced34fb9a2483d35f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869305, "uuid": "84e8652f-f003-499b-b340-4c19bf208149", "value": "192:3VZ73NPhaJp6yUyJl6fW7d+IhmTCMdZPr2sZ6V0LnjWOM6oA5qq2bVN8:FZJ8p6y7A+AtpZmKntogqqw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765869305, "uuid": "4e08fc5e-c582-40b7-8746-8ddf2df5c00b", "value": 49708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765869305, "uuid": "5afefe13-a4df-4aa7-8539-4766f6aacecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869305, "uuid": "231ac5a7-28e5-4a2c-8cfa-cc07a28fa779", "value": "072410494ccf5227297dcc0cdbff5ce815709177d74e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a949982a-da96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765900106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900106, "uuid": "f7f41552-ca10-48e8-a463-e4d5174116c7", "comment": "Malware payload (Mirai)", "value": "e8cb8244424a6d28b4a3ddaa1338b4b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900106, "uuid": "7558c92a-a6be-41c0-99b0-8c6ad75d0dec", "comment": "Malware payload (Mirai)", "value": "07cd8e38a286b52a3ccdf475802644794a90db93ecb9cc33a2e1ccdf12b25896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900106, "uuid": "3c1ec243-7bf6-444e-89bf-6e89f5717cdf", "comment": "Malware payload (Mirai)", "value": "f65cb19c622e43fe5a9415b1a81f4fbc561ab9d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900106, "uuid": "c516f4c7-a956-42ea-8e80-4bacad5e9937", "comment": "Malware payload (Mirai)", "value": "7d663134246bf8905cd7050da5557bf16ef38bb29b88da19abc4e85cc2d5f9bf2ac0eb8897710136c8b49906b4ebfca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900106, "uuid": "f4894cf4-0c4c-476d-a625-2e7938a9defc", "value": "T174B34C32BCB57F37D0D020B662C38536F57D4B481068DB29BD614DECAE3A5602766A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900106, "uuid": "f17b44c9-651d-4368-9cba-615f7a22f7d2", "value": "1536:2gEZeJIVWbHBvsNwcacA+RtJ3620+VAvwHmSjNOI0PGnjN2BcF:i7bNuiblHmSjcQjABA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765900106, "uuid": "27320a52-f01b-44a1-9762-41df48a6bd7b", "value": 107708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765900106, "uuid": "4994de54-63ad-4cfa-adff-f492e130d88c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900106, "uuid": "370b07e8-e656-4991-bdbf-aa7d4048bfe4", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96326419-da8b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895350, "uuid": "76a1806a-659b-4f90-8940-57b8121e2147", "comment": "Malware payload", "value": "03cfe2c6ee4cda3fb0ddcaafae85a06f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895350, "uuid": "b8415d7c-fb40-4c00-ab1c-19adbd4d6c3a", "comment": "Malware payload", "value": "0804027c756e2cb60d60b03f2ef61bb7df4b4d4f108f08c48fa4be4e0fde6324", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895350, "uuid": "0d5637ca-db2b-4524-82b2-6745ee92939b", "comment": "Malware payload", "value": "cc2c6cde0a9d0ee7e515bc1944af0a9c6f1ba39f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895350, "uuid": "e806c52c-7aaa-4b8a-8dd2-8ebe8bd8291d", "comment": "Malware payload", "value": "681fee64f681308b70412ba69fb0f8f6f76f838e480a922a63104b4c29719f6677f325fdf453ea0e533706ca927f390c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895350, "uuid": "682645a9-d11a-44ef-b706-2e21f6b95c77", "value": "T114D512BB58B2A8536A504677EB0F2C1A338B19D53A18D345E951909C3F7B0D38F92B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895350, "uuid": "36bf2184-5ad3-4cb7-bb44-1e35680b4237", "value": "49152:qOc2yD4lTPzhfrI6nssXV8AgsV6OtK1H4ofpw1Bs9GdiKo:qoyEFPNfrj6e6OtKxdw1uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895350, "uuid": "d3cce463-b2d7-4a17-8a93-4515b473d571", "value": 2959122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895350, "uuid": "e9622ac8-dec3-4acd-b08f-7fb762c8d066", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895350, "uuid": "e5b22f8a-3a0b-4696-8515-6656cc375b2a", "value": "Ahmed Alameri Transport L.L.C. SOA _ October -2025.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4853ed-daa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765907280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907280, "uuid": "35fe6ec5-a7fc-40be-a7d5-f7507d6742f5", "comment": "Malware payload (Mirai)", "value": "f3a0f464fd0cea7855e853547d893061", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907280, "uuid": "4cb85384-9e11-41e0-a1e4-81c5c3434894", "comment": "Malware payload (Mirai)", "value": "082745c1abd0e6331f40190f0e5d8ba7bb09339c521119f243c852c0da0c6ad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907280, "uuid": "5b37dd9e-da1a-4349-8b27-c51aa177567e", "comment": "Malware payload (Mirai)", "value": "5fb96f88c755a03facc216c4cb3d50b5ac3600fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907280, "uuid": "170358e6-dc29-4bbd-bcd1-fa8419aedea6", "comment": "Malware payload (Mirai)", "value": "a07a4b660ce8743d301ff4642c566aa5fd91e2fcb5b0043876baa6e862cda17007d6f3b087877b8c72445466debe7c28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907280, "uuid": "16073a69-67fa-4631-b49d-9684081aaf12", "value": "T17FC3F8456C51CB11D9D363BFFE5E55CC332213A8E3EEB1179D102B59BB8A02B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907280, "uuid": "a99d3baa-0c16-4a67-864f-8d22c23f1091", "value": "3072:UXzJWVNewRV2ma+5XqgKDpeUz/Sk5Vnp5Tu:UXlWVcwRVs+RzKDoUTp5du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765907280, "uuid": "2f5a89df-6501-4b74-b73f-2f5f15aed975", "value": 128192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765907280, "uuid": "4e2e4f80-f3b0-487f-8e50-82fb9909b880", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907280, "uuid": "d944c586-71a6-4a09-91dc-d53cc0154097", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1215e4-da7e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765889644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889644, "uuid": "11a505cc-37cc-435d-9ea6-fc8304b74f3d", "comment": "Malware payload", "value": "d87c91f72063e0f8f0d17cc9a9b09ed9", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889644, "uuid": "9c8fdabb-bbad-4d1c-b049-ecc48b4a0e9e", "comment": "Malware payload", "value": "089992c730b21350721fe1f449bec08e8f3293feb3876d027606f592e4762ee5", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889644, "uuid": "47101bb4-a534-4f5e-8568-dd515e4ab3c2", "comment": "Malware payload", "value": "32063055a6b42ba84b83aef799acc94bb987249c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889644, "uuid": "92cd6291-6851-474d-be5a-4815ccd29e0f", "comment": "Malware payload", "value": "36339a3af217c6626c4dd1c1ae66b57409663fc4f333e88cf0497a4b09b34c9d641c5fe2f6b429ad4f14050ba8821b19", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889644, "uuid": "7a153043-64b8-4ca1-8363-53771c7aa1cf", "value": "T1EBB57C229654D1F1EAABD07CC975463BE2F0781807B0A7E76AA9C1311B23EEC727D744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889644, "uuid": "a14a64fb-c5a9-41ed-b4d7-aac5177a5dae", "value": "96c4f4e8917dc64df4c59957846701ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889644, "uuid": "df22e9d9-aa6a-4031-ac07-1043e5bd2262", "value": "49152:qJNGtlq1XVwASOHjAdgb6j9VohWcd2jNhbubJf41IU6iqsbqoeoPw:q/E2FhWcChbQJAS+Lbqoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889644, "uuid": "59285042-2d2f-4f9b-95e2-7423ae17e3d7", "value": 2293248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889644, "uuid": "0dba649f-d753-4d48-8217-f22fa1d6a0de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889644, "uuid": "adabc893-b200-4510-9e67-c454828ed333", "value": "libeay32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3076c6a9-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1765896038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896038, "uuid": "a80d69bd-bcd1-4ebd-98b3-79a0d177481f", "comment": "Malware payload (VIPKeylogger)", "value": "73ca899bcbc84cd524cb3a8a29f61852", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896038, "uuid": "7f9b7684-4233-4522-806b-bfec75405640", "comment": "Malware payload (VIPKeylogger)", "value": "08af14aab725a9c6a3fc2b79dee32d574bccb207ec3da8cb47107d0efa9e2a0c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896038, "uuid": "d37c4e99-9ffd-4a9b-a8ae-c88d48bcc462", "comment": "Malware payload (VIPKeylogger)", "value": "a929cf222b9e062bd490ead9bce2aac23d9c0c68", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896038, "uuid": "53866d83-f8de-408b-9680-3630a25aabf5", "comment": "Malware payload (VIPKeylogger)", "value": "e1d77238f563932ba0c369392fcf4ebb152517b6279eba49e87ce89fb26291e176e22dad55156d6b8f0018f35eb8c399", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896038, "uuid": "8eef3d09-1796-4444-8f97-1edf09dc1942", "value": "T14C942334B713C6E6FA01B96859CE836F61CF559F4F1933EBBC4884401D2273D53AAAA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896038, "uuid": "db3166ce-975b-46a1-9565-3e49e929d165", "value": "12288:ZpGRF7bReYZpfOSDjtV6/5WTME6Ot+ptLDFWjY0jzy:ZUPVnbDxQBW4E6OtILDFvuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896038, "uuid": "9ba7f9ce-0d7f-431b-92c9-31c3e50fc766", "value": 423713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896038, "uuid": "1e4073de-618e-4f04-a385-bfb7bf070966", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896038, "uuid": "5703e7a3-30fe-405c-ad10-a86704eac59b", "value": "transferencia.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7385e098-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879830, "uuid": "80052570-598c-49ea-9457-927abbbe5e62", "comment": "Malware payload (Rhadamanthys)", "value": "60cf2e6bc5733edbfc15510b4f749f89", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879830, "uuid": "5d3b2aac-275f-4d58-b90a-37f441c4d076", "comment": "Malware payload (Rhadamanthys)", "value": "09089d8ca6628814995b898b0e631ce113f833fda7d748a37963d5d4368eba29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879830, "uuid": "2c3bc5de-54ca-45b5-926c-462bad1f6ca9", "comment": "Malware payload (Rhadamanthys)", "value": "09cac9e9d6da8c558b5fc42da37dbec49978d5c3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879830, "uuid": "5b7f61c9-b65f-45c3-8468-eaa72c8cb34e", "comment": "Malware payload (Rhadamanthys)", "value": "49da234c363e18166a39d33ccee03829cf4cf59db4246963f58d39686a33cfcaacf88fffd2b6231578855da144ba0c10", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879830, "uuid": "da95f9aa-0158-4add-b6fc-afa4bf27509a", "value": "T117A31A1AD94154B3630983E26E8702F0D4D365841EA0E9D2ED67E6E3FD1E4527EE2FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879830, "uuid": "131229c7-d3d3-4c00-8c53-fbb3966066b0", "value": "768:GDhd0i7J4sYKgY/CMNfWddPjg3drXn7rVBeaHD8Y7Ac1ieSLAuAAroQW+FF+Ec+p:GDB7eKg20JyrrrVBeQnAc8e6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879830, "uuid": "b9de92c2-6250-48c8-942e-8aaacb3cbb0b", "value": 101425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879830, "uuid": "f743f3fd-3a76-4ebb-b4ab-d2a6d7799c66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879830, "uuid": "06ac2dbf-b9f4-4ae6-8854-0d62d40cd496", "value": "invoice-1637482117.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167c560a-da2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1765855622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855622, "uuid": "a89858e9-151e-406b-aff4-770243b49bf3", "comment": "Malware payload (Joker)", "value": "24d84b4b784d1887e6a93ad7dc64c311", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855622, "uuid": "b255cbeb-c1fd-48b8-8d06-34d3903a3724", "comment": "Malware payload (Joker)", "value": "095492f94dd1cd1b268772e504829e6758eb97f2a9ed6fbec53ebff3930a5fea", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855622, "uuid": "5c4238ed-30ef-48db-ada8-4e69f4d78365", "comment": "Malware payload (Joker)", "value": "cba92ed20f83590ca194149f25d81e461d9f7044", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855622, "uuid": "fcdfe179-67c1-4b38-8895-3d8e80e07f03", "comment": "Malware payload (Joker)", "value": "7b41d807bad8b5e53a250694574f9236d9b6eaa9205d678cfd16d035bf33b0aac9bb6e368440eb329b487cf38d615962", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855622, "uuid": "38d77780-2b89-4296-96f7-826c531c9f5a", "value": "T14757220BF70DA82BCDE5B2798D7502226123ACA84746D3D32911B239BEB76D58F15FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855622, "uuid": "ff4cbfef-6a51-4e26-8635-03fdd667e4d9", "value": "786432:sWNvVqKKGHPG5ABaCguDu32xSOp+2m6wHEuUXx:sWpVqJW+5zC7SomeuUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765855622, "uuid": "8b03197b-942d-47b9-94ee-6e058155a53b", "value": 28112444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765855622, "uuid": "9e1080c9-83f9-4983-a157-03fe88340b04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855622, "uuid": "89af4f9f-6183-43f4-ba43-e2b6ff32d40b", "value": "File+Easy+Cleaner_1.0.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d093e757-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879986, "uuid": "f4e25d0b-0e96-4161-8abe-7e9640a37817", "comment": "Malware payload (Rhadamanthys)", "value": "d4318a5ce16c0764ec0f359bbe6086c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879986, "uuid": "904028ef-7247-4793-8b43-b7e0745b43c8", "comment": "Malware payload (Rhadamanthys)", "value": "0a2d21cca9d9a156313b8f6696c3106bc0708e609ab46bcf6e839aec838796f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879986, "uuid": "cfb69cab-d48f-4f91-be3b-1b3e7ff57b2b", "comment": "Malware payload (Rhadamanthys)", "value": "7e83f6b319162304da4cf0097dde167bd6ac6443", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879986, "uuid": "eff33baf-1dda-4634-86e1-d50e331eb196", "comment": "Malware payload (Rhadamanthys)", "value": "5b6f5c3a99da2afabae5331ae0ca85315d083ef0d35bdd4982fad554e7bb7e0f9c7ae6878ec0a4f5c6849e5dd329638e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879986, "uuid": "9e83d661-6ad8-42ff-8117-29c8ce2c0359", "value": "T11CA3F8410FC2E4F3C2156BAE2FD93A60700941C14DCAC4569C8E77A6F84E76636AE5FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879986, "uuid": "ce3f7d20-9e14-4d6c-a799-ed9bc08f7758", "value": "3072:GDB7b03fuKTaxNGU8542xIx11KxYucMeVweSjFj4S0DWsZRYqdCidzZdKMoRsnNW:0HbE3FWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879986, "uuid": "89c05971-e740-484d-90c8-af6fb96b26d9", "value": 99538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879986, "uuid": "2514c8e5-f4ce-4943-b03e-6ed6d24e9c42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879986, "uuid": "1ea057cb-4fb8-41e4-9849-9231c384f573", "value": "invoice-1637482117.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94625dea-dada-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765929277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765929277, "uuid": "5caf8e0a-b218-42cc-93ea-715360872c35", "comment": "Malware payload (Mirai)", "value": "52fec9ce32db2f9c3c71cab18365c413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765929277, "uuid": "bc5a4878-34dc-40f9-967a-be1fd10ed89d", "comment": "Malware payload (Mirai)", "value": "0a5ca41f7bf0fbc67c4a399507044e5de74e157a74dfaafa604a35e4561287ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765929277, "uuid": "5fe9ea55-8c17-473a-9ed5-3649cf034b99", "comment": "Malware payload (Mirai)", "value": "6777b1654bfcc2f8e1651b1c2fb12f8785367b48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765929277, "uuid": "f0ec6286-b22c-4389-94bd-817c9615607e", "comment": "Malware payload (Mirai)", "value": "1fe946f7d2bcce6ff7c418b75cd3f24076a6fa71415657cf7154ce4c4ed12774b45bb6fa63f58b5de5a35d60ded44f4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765929277, "uuid": "29c0bed0-2fc7-44ee-9fc3-8c4364ef8afb", "value": "T1CCB3E756BDC1AB11CAD363BAFF0B929C331213ACD3DA72179D146765778B0270E3A44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765929277, "uuid": "7587c8e5-b7d7-4e70-8fdc-9e9be89327c9", "value": "3072:KgvdCB6FGH0Xm4ojZa4xWGCYNtCb9w4bGWVnnX5:KgvsB6FGzZlkGXNtg9ByW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765929277, "uuid": "8bf0d0e2-145e-42c5-8342-65a41212795d", "value": 111792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765929277, "uuid": "820081d3-31c1-4d87-ace6-72a5c5c3ff6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765929277, "uuid": "2737214b-f3a3-4c1a-8ae4-6cedea329593", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05b903f-da7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765889488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889488, "uuid": "3c5083af-0634-49b8-8d05-654e77e669d1", "comment": "Malware payload (Mirai)", "value": "b13b034c4815c204e1f9380ccc42f3bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889488, "uuid": "b07f32bd-b8f9-40e5-887d-6eaf7bedea9f", "comment": "Malware payload (Mirai)", "value": "0aa7bb7ef98a18559affd84b8b22405f38f2bcd6e5d7ff3765d7fa1ac3d13d56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889488, "uuid": "bc757f3e-8e7e-4343-b838-641d8fff2cda", "comment": "Malware payload (Mirai)", "value": "635905001257f8bd8b0082361fa7578b2cc2f773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889488, "uuid": "56e1b75d-44ae-497d-be54-9b325fe97d75", "comment": "Malware payload (Mirai)", "value": "284d201a4fdf590f8f5c3f5f7fb8e1f3f7e926ea91db115ceefa74046a9f74489f51c417fa5e2023c0a312264cb47339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889488, "uuid": "89056e8b-56e8-4717-86a5-aa4d2d52475a", "value": "T148B3F724ACC49B15D5E723BBFE5F118C33166F98E3EEB016D8102B65738A51B0F3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889488, "uuid": "88166c3c-123d-49a7-b2aa-3b0b0327a032", "value": "3072:cEy0vwtN18W2peMxbBinF4HqJ00J3/3OVns5:ty6uN18W2p1xtinF4HqJD3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889488, "uuid": "a2611634-952e-4b7c-9a3b-6bf40370f05a", "value": 112820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889488, "uuid": "b677bab9-7b13-4aaa-bf99-90285a83a3ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889488, "uuid": "cbaac375-c890-4dd4-b852-f067bdd5467f", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19fbcf1-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1765883343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883343, "uuid": "7d62dcea-bc88-41d8-9d74-8786052e50ec", "comment": "Malware payload (Cobalt Strike)", "value": "cb5a7ef75bda312fe7efecb9fddab236", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883343, "uuid": "4b5d1304-513f-460d-b75e-b83c71199d92", "comment": "Malware payload (Cobalt Strike)", "value": "0adfe8dab1b4339ffe2f36fadc728ebecf67dbc6077d2b62811ca4f60753ee70", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883343, "uuid": "28a31323-c9fa-428e-9659-d498359d98e7", "comment": "Malware payload (Cobalt Strike)", "value": "4064a9493d87bfc5eb8aacddcefa9aff63f23bd6", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883343, "uuid": "ca9ebbd0-a438-4243-9729-98146f5ff3c9", "comment": "Malware payload (Cobalt Strike)", "value": "4b95b58f592210d907f69d709c60679bb40d9b28a2bcbe4eab5fabe945c2f4afeb4f61e84116570762fe63233a45b02f", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883343, "uuid": "cb91b42e-4e96-426f-b73b-9c4321e269d6", "value": "T1AF748F123F9328BDD200F33BD6B1A9D68980287D68F54D01F9E75D282AF16DD89F4267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883343, "uuid": "fb8c83b3-7f97-4131-90e9-d0d1b517c7b2", "value": "6144:nPgFNupx3J4MKjeiE2P6ICewYKTZZ6lzRj5zlIwW:nPgGnjKjKKblK6dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883343, "uuid": "cde4841b-4506-4ee7-bbd3-9b6f8a205163", "value": 362024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883343, "uuid": "1e7decfa-177a-42b7-9f7d-e7d8c85a620b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883343, "uuid": "7408f5c5-32e3-48da-84e5-b8a0b2bae0ff", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320aff48-dab3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765912362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912362, "uuid": "9f30a0f4-5c2e-4f07-a4e8-03aa99bedcd4", "comment": "Malware payload (Mirai)", "value": "d13a0ff53f2b6cd83e9c3f70361605e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912362, "uuid": "c58afa18-c524-436e-9d7d-10f7d1a0da71", "comment": "Malware payload (Mirai)", "value": "0b5aedf8b7385a8ef71df141a6dfa77d66290cd16e706f648cd508220ce12fe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912362, "uuid": "a8fd260e-ad1a-429b-a8d9-224ab46f7072", "comment": "Malware payload (Mirai)", "value": "d74649fa883e62681553c7f79246eb82ddb5b224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912362, "uuid": "43c2b449-c7b1-4260-ac8a-6bad93804a7f", "comment": "Malware payload (Mirai)", "value": "1da7db0749c44a46765346891798cdc5db5a04038504a0be86ef0e35ea53becc7fcd46712d15b6e97fa288a6f18239c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912362, "uuid": "2b1b77db-677f-4684-9bf0-396517b4d6c4", "value": "T1D4B33A21FCB46D37F0D0687A41C3823AF9729B0910E8DB69FD611DDC9E3D9602A5B672", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912362, "uuid": "44f49bf3-7e98-4da6-9694-c220e9100018", "value": "1536:efeZegJ4VWD+HadecfouPML4HQ8AtbFCLSE0d9nboA83ATFsfc4Wd/ujNhuhABI+:emvM4Rgur6prYwTe0CjNtBIj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912362, "uuid": "2d43fd4f-fda7-4244-a077-ec3395042c9d", "value": 108164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912362, "uuid": "93fbc4bd-f556-49ee-a9a2-2d64c28361b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912362, "uuid": "8b199a35-afbd-4d07-890c-389d1f9103c5", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57fd54a-da6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765881283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881283, "uuid": "11c6dcfc-5a76-47a1-ab99-3e5f82accb29", "comment": "Malware payload (Mirai)", "value": "0d7aba2662dd61d5ebbac6ddfdcd0776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881283, "uuid": "afe686dd-3342-40c2-8b29-85f90a7f303f", "comment": "Malware payload (Mirai)", "value": "0ba45a6f456f394e6b280b2b4cb589d3e43cd5ccb7de60bf79eece7af7530041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881283, "uuid": "8f55648b-e604-4b89-8c8c-c8e9d5f27980", "comment": "Malware payload (Mirai)", "value": "2aa83f9efd8b69d5f453decd748d4eb9248d6d74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881283, "uuid": "0eac8031-aeaf-4eeb-ae74-276fcb775b7d", "comment": "Malware payload (Mirai)", "value": "ef5e6e97cd6aa7c52b2c3d9162733f0b676419dbde0ffa76a25fc7cc836821ddab2b53f281e0cef686fffa94db63a5b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881283, "uuid": "714fb11e-bd25-44d7-bf77-e52ef41e116d", "value": "T17993D71E6E619FBDF759833447B74E21A34837C622E1C681E26DE6005E7038E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881283, "uuid": "d3343c68-1b74-4051-b34d-c9f6be0a2537", "value": "1536:vXvbhLtVV/jTTZX9buXG8MpyeJvqJvVCvuM6oGWjigNMKueuHm396SI:vfbhRVVHTZOoGWjigNMK0k96r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881283, "uuid": "a341a8c1-60c5-4db5-a7d5-b4822cccd348", "value": 93384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881283, "uuid": "844fee64-8dbb-421e-b2c3-7502bc34b134", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881283, "uuid": "1f9c0b17-4e6e-4639-a5b7-f4a595e98caa", "value": "kmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66bed0f-da4f-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1765869607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869607, "uuid": "3c37635b-6ca7-4d18-861a-e36d7f7759ee", "comment": "Malware payload (CobaltStrike)", "value": "bf789943008ee57ce0a91a644fd2917b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869607, "uuid": "756881bc-179f-42de-ad43-86935cbd3720", "comment": "Malware payload (CobaltStrike)", "value": "0c0eb52c996d1ef6cdc71d1cd48e73cbd26eb01b6c971cfc38c74db27f4b4eea", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869607, "uuid": "4ed609a8-eae1-4da1-9ee4-5a761fbfe399", "comment": "Malware payload (CobaltStrike)", "value": "c48945cc04a4a2f690e5a0563115e66bb9edbec9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869607, "uuid": "993a1828-4183-48f7-9c08-cf56fa1de1a9", "comment": "Malware payload (CobaltStrike)", "value": "b6df11895fb8e8bef2c1b3ca7fa2b965ae92956f9bc37faa660b5d94a1f744a94989b02a8196378a9fcf945f61840d2e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869607, "uuid": "4b88fa57-d723-409b-b894-8757a1dcb3f7", "value": "T1AB13080DB2425CBEEA3AC0F880AB63B7E5A17411519747FA0FA1C3365D617E8D7A8CD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869607, "uuid": "21807256-2a7c-4011-bc5a-dc76a3713196", "value": "816ae724a4de7fdc1aef1aa62b788e21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869607, "uuid": "2880348e-153e-4057-a739-432077de3732", "value": "192:WDthsdBeC2ZHNvtAJhg9FATiRfWx8WsEmTCMX6pJpN3EmxevShRf1AhzIMhEy+2c:cXsD2pNvehg9h4ItAb/qI21+XKRqhLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765869607, "uuid": "d2845aec-4ff9-405f-8490-b2041e141a8d", "value": 45380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765869607, "uuid": "00d7ac29-34fd-48c1-b994-18d89f46ffce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869607, "uuid": "c22db635-c5a7-4e5e-b2ee-6f146b2e17f4", "value": "0c0eb52c996d1ef6cdc71d1cd48e73cbd26eb01b6c971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6693f2-da5b-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1765874803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874803, "uuid": "234c4c4e-0fd6-4efb-8918-0abe9936425a", "comment": "Malware payload (WannaCry)", "value": "937b152cd14bf6d9c11901425cfbc549", "object_relation": "md5", "Tag": [ { "name": "38-55-205-7", "colour": "#9A8F12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874803, "uuid": "ae957a63-704f-4842-96d9-2b8fa4d3ff3d", "comment": "Malware payload (WannaCry)", "value": "0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c", "object_relation": "sha256", "Tag": [ { "name": "38-55-205-7", "colour": "#9A8F12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874803, "uuid": "de23f584-cfff-4411-8019-c0296cc9ff8b", "comment": "Malware payload (WannaCry)", "value": "e003ec10d87f3e1cc1039515fa79da33310c8f66", "object_relation": "sha1", "Tag": [ { "name": "38-55-205-7", "colour": "#9A8F12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874803, "uuid": "e4d14885-774f-4b84-9951-0599cda7a7ef", "comment": "Malware payload (WannaCry)", "value": "9da41993d78194bab8755a669be0535b9b449ac447b891871052ddc7849181849092d620fe3ca621b33792921771db2f", "object_relation": "sha3-384", "Tag": [ { "name": "38-55-205-7", "colour": "#9A8F12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874803, "uuid": "86dce954-c901-4c47-bd64-3cdeae9ecf97", "value": "T1CFB5128A736851B8F025A271C4A74B16EBF33C991377534F9FD08AB61F13B946A24723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874803, "uuid": "8c190fb8-8751-4101-9a29-26570ac26e1b", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874803, "uuid": "93a8acdd-3da0-4a96-8cc0-44be38c15aeb", "value": "49152:QnnMSPbcBVQej/1INx+TSqTdXP6SAy/utMv12f:QnPoBhz1axcSU96SAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765874803, "uuid": "e40d4001-770a-40c5-b760-3c0410c9ba3b", "value": 2281472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765874803, "uuid": "4f91f45d-4e53-40b7-9ca7-af9af3432a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874803, "uuid": "92c8ddcb-cd6f-48cf-a617-fa66a960ce62", "value": "0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fc8730-dab8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765914517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914517, "uuid": "07f932d3-f20e-49c1-815a-a41e24a076c9", "comment": "Malware payload (Mirai)", "value": "cc9a768e572acbbbdb4b1dae70a8c1a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914517, "uuid": "a7384edc-e0da-4fa3-a6ea-8b26723e4560", "comment": "Malware payload (Mirai)", "value": "0d51bacb7dda4541ed73b8c96c0f275feb5b0605b3c628f79bdd3db9549de4e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914517, "uuid": "44e710e8-9124-484b-aeb9-1912f5b6aa9f", "comment": "Malware payload (Mirai)", "value": "ca9e36a99e1d01cce707630e86eb976cf37fd06a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914517, "uuid": "f1b7ca3c-47dd-4b41-a9dd-074123afb854", "comment": "Malware payload (Mirai)", "value": "dcfec43e72d0f95431034ea16aae02ba6da63f9a4b9e5b9804da0e065169d22ac1c8492e1a7e90f35d81f297b6c076ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914517, "uuid": "88d8ed45-0b07-4950-bced-558c60119b62", "value": "T12CA318DADEC3C47AF44B14B1D0B54B72CB34FA3E0649DA87EF64983899D12319254BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914517, "uuid": "a71f4edf-5af4-4683-acda-59586be730f3", "value": "1536:JTFKTBwzvnO/t2T/S6g9YcM+lysVAhvG/GTjtNi2jG30GDQ4b8lMioDgRREV:JTFKTBGO/tJh9bflyslWjtDK3bESEoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914517, "uuid": "d6270239-7b0d-4f0e-8cff-64a05a4e45d1", "value": 100176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914517, "uuid": "92e22bc7-d5ad-400e-a241-8b3041a2c76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914517, "uuid": "c7a96264-fd71-4a3f-af6b-f83b9acfafec", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d78ddc5-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879766, "uuid": "214da22b-c46b-43be-bacb-0a0faaa40f38", "comment": "Malware payload (Rhadamanthys)", "value": "0c5a1681a75eae5b18615ef0850a7163", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879766, "uuid": "2d058e27-48f7-49fb-accc-33e76454d678", "comment": "Malware payload (Rhadamanthys)", "value": "0daf3c5ccfe8afb88333f5a457a5f4f38c9dd030ad87197c57ac9baf333f2cc8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879766, "uuid": "6cb92e80-95ab-4ce3-aedd-8d5791f68a1c", "comment": "Malware payload (Rhadamanthys)", "value": "664f6f43c617029ebd9893404e8a263885cff7b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879766, "uuid": "0f33259b-6631-4cd8-a5eb-f28b0f5bb1cd", "comment": "Malware payload (Rhadamanthys)", "value": "b94c163b72b9b4be8a2881b1eec006f5f2e757e74e1fd1a310d1b7aebd30a1f70f434aeb517b590996532bb61b04f12e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879766, "uuid": "fcc3f569-834f-4b1f-827d-5730ca4e0f05", "value": "T1F1A309C7792DB8F815D72B73EC4628FA98A1DB0343261929C93B7626019472DEDE5CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879766, "uuid": "3cfcdcc5-8cdf-442f-8421-2a8bfb68b60e", "value": "1536:GDB7eKg20SROxUDfz7DT0ETxmpZfBp7P9tfFj0775GP2OeAsEvNEoSsIm3erwdtE:GDB7b0cNvW8OT6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879766, "uuid": "b59756cd-f243-4938-b9a2-a01150dadc1c", "value": 100725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879766, "uuid": "9f5df003-252f-478f-8105-00ca2241f498", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879766, "uuid": "46a60ff8-49a9-4fc6-ae05-4a96afda7520", "value": "invoice-1637482117.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8447ca-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879439, "uuid": "41e18b78-1ab8-4173-baae-857c7e451a3f", "comment": "Malware payload (Rhadamanthys)", "value": "9cfd22010363f6c804df37bb0f577f0a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879439, "uuid": "867c947e-a607-42ab-a7ea-8e1db733bb59", "comment": "Malware payload (Rhadamanthys)", "value": "0deb15e02c59ed8834f53e88f37fcd4f4caa34f31f369d110ef2e55e8ead8851", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879439, "uuid": "2b4e99e5-68b9-4b12-bec2-025bfcaf54f7", "comment": "Malware payload (Rhadamanthys)", "value": "a8db5c9cbdf006ae877624972cd5b5266523e235", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879439, "uuid": "54858c50-77c0-451f-bae2-78655fe827d3", "comment": "Malware payload (Rhadamanthys)", "value": "e6aeb5eed3170d0b66c5294df4e3f94f4508cab0e528b50505fd97aeb72eebe158c62bb18eac098fedcff2da6cb497d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879439, "uuid": "cc42f13c-6e54-44b9-bed3-55c5267685e9", "value": "T1B4A34D8DA93B15E412BC912ACE49F6CB363C242A9487A360531FF37F175851798B6BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879439, "uuid": "d2c23be3-b1f8-403e-bd78-73398baf9a57", "value": "1536:GDB7eKg20sC1Yurj6lVbTEn5eG+fVsy/cFlFlyT9kYUbC3aCODj++PXrrfYp+rs+:GDB7b0l/vyg4l6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879439, "uuid": "0c6f96bc-5d99-4415-9ec1-141f3b1c25bc", "value": 100188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879439, "uuid": "44843134-2dc7-4e75-8158-ee22fea054c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879439, "uuid": "22b82c51-575f-4206-a066-34c12a8c84e4", "value": "invoice-1637482117.pdf (95).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6193628d-dab6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765913730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913730, "uuid": "4a8dea11-b883-45c2-aadc-370f58b3f523", "comment": "Malware payload (Mirai)", "value": "c958b0f49ae6a73a95ffa277d14a6a0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913730, "uuid": "8fe1cde2-ba74-4524-a908-4ead884c434a", "comment": "Malware payload (Mirai)", "value": "0e1d537e94f3675b307103eb36f31f8697ab28d8c6ef99a0a65dbd54ed6bd3e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913730, "uuid": "e2e61c61-ec39-45dd-b8d9-169b3e0e8f2f", "comment": "Malware payload (Mirai)", "value": "b48fa596f8f35fd5732fd8e0733f27a451ada52c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913730, "uuid": "4028244a-fd20-48f8-a207-cc9cb14a138b", "comment": "Malware payload (Mirai)", "value": "364b815cd7d9138b7699333533c1d40712acc5f507917b4ffb644a6b65848867e49f2b4e806afb1569be1dd34775c0af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913730, "uuid": "31c8bc05-4a98-4a33-930c-8504a4bf4642", "value": "T118E3C4097B601FFBD85ACD3745E84B89189D564236B83BB53A70E904FA1A24F0AF3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913730, "uuid": "936913a0-a8ce-4659-8b96-4c0606033bc4", "value": "1536:4Y/087FhMkk2i3lsSfrzFXu+pTjPZtGxc55dCp5zSax1UtuShjulWY1OJXxn6MQv:4Y5wkTiJfNXu+F3nkShjE6nT8n1z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765913730, "uuid": "3f2bf970-1935-4d61-87f6-1a4122c3ae17", "value": 155524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765913730, "uuid": "a1a3836e-64d9-4339-a45d-d3130831bd06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913730, "uuid": "a87ad1fb-c3c4-4440-9ece-fb544e852c24", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171a0664-da85-11f0-a129-42010a9c0007", "comment": "Malware payload (Fuery)", "timestamp": 1765892560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892560, "uuid": "bbc4dd5e-6eb9-48bb-8e0e-b6dfdba1d9f6", "comment": "Malware payload (Fuery)", "value": "f92a58cdd2a53e3f62363544a9f6cfc0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892560, "uuid": "d3d7763f-e582-4e94-8aa0-3f89be74ae51", "comment": "Malware payload (Fuery)", "value": "0ea8da9e3914ed8fdabc6513ad9fc7895fe7e74e0e59b9bce164863493ddaf83", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892560, "uuid": "f7bc65b5-48c6-4095-acb6-75c8a7c55c5f", "comment": "Malware payload (Fuery)", "value": "13c09be1d5b9d77ea0cf8320e4620dd4d145f61c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892560, "uuid": "4021352f-54cb-49c4-a043-fba2a5d14d7c", "comment": "Malware payload (Fuery)", "value": "bc0e80a38ef9f4667fb62366702e1b27b85ac509ef1c7f702db982609cf95f29a532752a648894c45d1c136740718e29", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892560, "uuid": "e96c1f6d-e74e-4cb7-9feb-43ad8605bc3a", "value": "T17B54F14567EA1421F2FB2DFE1977426B5A76F8619B309EEF1580091E2A20BC0DD307B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892560, "uuid": "60fcf694-b29f-44f7-bcce-8caefc576c31", "value": "df7a8c015a0eae9e08c9e52fd7e541b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892560, "uuid": "6ac3b8c3-017e-4634-b05c-63a5507544ba", "value": "6144:8kb8LCLYm+J9N6kRercKUs9D77rvPYgSYe1msy0VnLQh+c:Lbc3j6szXeDjvM/1msy0V8wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892560, "uuid": "0cae32e8-71b2-4e0a-88dd-64f5fc9dbb40", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892560, "uuid": "1987f4bf-5eaf-4365-a2cb-f4b756fdb0a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892560, "uuid": "57fe7d08-65bf-4c46-b949-b088e783809a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fa1662-dad4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926701, "uuid": "601c12ec-c73e-4ce3-9b98-758ef8d0fa1f", "comment": "Malware payload (Mirai)", "value": "ab1a27dda4e3cabea16d2b41c1613fd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926701, "uuid": "46248015-299d-46de-b540-803fc458d9e2", "comment": "Malware payload (Mirai)", "value": "0f6b0327fb3d814eab9fb2a7674195a381936da4e4c4dcad7f42553d37dc0b28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926701, "uuid": "8ccc7f67-a0b5-40f0-8851-d4fda4a474ea", "comment": "Malware payload (Mirai)", "value": "f1b5d5963409bb1b26e7a2500ea9ff0338ef1316", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926701, "uuid": "acccb3d7-50e5-4e62-b9ef-84e281202238", "comment": "Malware payload (Mirai)", "value": "1979d49912026c7d0b11d8ea5dafa97ef0a905514dd7a29cb46117cb05fa216959e9c3833f6b0ab5db83080aae93e332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926701, "uuid": "7e70e6b1-98c4-4a31-96c7-6236d8921fe7", "value": "T16C93534D3E314F7DFBAC82398BB75B209209339626E1C584C1ACFE021D7479A745B7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926701, "uuid": "4c622222-bc9b-4506-b78b-3bd6cb4216af", "value": "1536:OGuOLw2qT9E3TlWGTAUBPufD/Ne2ajqBVIVotKtSPyEr:duew2qTC3YGTAUBmDE2ajqBVIVotKkPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926701, "uuid": "bde9eebe-cda4-4249-bffd-a267e75cf432", "value": 97492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926701, "uuid": "3360ab0a-1ec3-4b37-ab33-d07c28ba2f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926701, "uuid": "ee41a772-60e4-4053-9a61-5ce87161bf11", "value": "Fantazy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac7b405-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879493, "uuid": "76858cdf-1404-4eb5-830b-a261f9511eb2", "comment": "Malware payload (Rhadamanthys)", "value": "f1cebfd887d1727a180def2ef3dd4b8a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879493, "uuid": "1e80ca8c-c550-4f13-aa37-3d0e829bbea0", "comment": "Malware payload (Rhadamanthys)", "value": "0fb4ea4fcc9e9c5e68f7f103873e3c30a2b06e26db200c616e7b753f8f61e1cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879493, "uuid": "775d5061-35a4-4d64-b11f-a0dd3f51443d", "comment": "Malware payload (Rhadamanthys)", "value": "ff0608640cd8f3ee5bb5d91f546f575e4ae93ead", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879493, "uuid": "adfd4fc4-d454-4d74-9b8e-4695ad2e43f9", "comment": "Malware payload (Rhadamanthys)", "value": "b421cec927aff06699d51ca9a99a34fa100ddff884250b6af66f12c6f49ce4181d80596c8d9ee715e7c51e19f963fb85", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879493, "uuid": "992af687-2034-49bb-9638-47a1d1fb133a", "value": "T1D4A3E7022B33DCA0C04D782E7FCE8D95AA15855B2EAD85BA714EF3D2C43D71998D41EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879493, "uuid": "03ef0da9-b228-4f32-82e7-3f62cf5a44d6", "value": "768:GDhd0i7J4sYKgY/CMNfWdjdZRVn6YNTetHuUAZlJS0pFCPCTPjLbWiG8TtjrXNN1:GDB7eKg207rNroQ6TgAlSm6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879493, "uuid": "0e0b87d3-ab06-42f7-82f1-6cce5da565f4", "value": 98753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879493, "uuid": "8bbf0b3f-842d-407a-a6b1-e773f0ca75bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879493, "uuid": "292e8188-5e6a-47fb-9f95-69bc8f05e0c6", "value": "invoice-1637482117.pdf (88).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4dc5a2d-da8b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895374, "uuid": "6207e6c0-5398-4a4b-8d80-2c8ca46e6bd4", "comment": "Malware payload", "value": "3542e2d3d48684de62aa78dcad08924e", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895374, "uuid": "3ec23acd-320a-4407-9ca3-0ed502faf027", "comment": "Malware payload", "value": "0fc5ff7a76844fca91b902638fbaf2cd839d4f034c07ae66cdcb8a9b07223f2b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895374, "uuid": "78463182-00e8-4bd1-88a4-ac67012f6c97", "comment": "Malware payload", "value": "099f33fb8a5ee29faec410a4f68fa25d42d71d7e", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895374, "uuid": "cba7909a-1c45-4535-9a06-a7d9baa2117b", "comment": "Malware payload", "value": "2d1a6c890e02b55ae604e07ecac7a8d9be44c1cb5b551f4b4906b339bcf4a6bb8ffc70e021aa8ee506c6790a368d237d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895374, "uuid": "7e3c9359-5ebb-4e48-8dce-214dfb12d5b3", "value": "T17134129DE743F999C75B9C7C02CA04F38E5DC907E296B20F0884A89D5F128C657DEAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895374, "uuid": "ade34c2e-872f-4954-9410-d69a9cb0589e", "value": "6144:97i5V1b+yP5TeJL7pz/gh/HIcpdoxLzKLyHywP6a/:97W+yP0Z/6/Lp2doi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895374, "uuid": "24542105-26e5-4dab-af27-4b6685970728", "value": 238297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895374, "uuid": "a4f2d32f-ad32-4896-aa07-ce2a59e1a04e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895374, "uuid": "4fb29a1b-9a29-4849-89ab-952b0a1d3e05", "value": "Acompanhamento Nfs Pendentes.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d714aa04-da81-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765891164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891164, "uuid": "5ff37b15-a633-4a3b-aada-66bfe29e72a9", "comment": "Malware payload (RemcosRAT)", "value": "056d57412c6c4d910f775a591b162fa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891164, "uuid": "2a91524c-7885-4081-a9ce-38a84af2dac6", "comment": "Malware payload (RemcosRAT)", "value": "1104f14d6b21fafb2136ce765897498ae414a71b28382bc3de9365e143d38d11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891164, "uuid": "9bc7c5ba-71a4-4c28-b490-70c931bf5472", "comment": "Malware payload (RemcosRAT)", "value": "bf114b6411fe3823ec3792c11625afb0d2b20a19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891164, "uuid": "36255d54-ba55-4289-a718-4b00a249a767", "comment": "Malware payload (RemcosRAT)", "value": "889fa5222ec52eec6af5d04e07d6a048bbef4f5cfba2e32d973190f9a1e0eb27d27674093b55877d884375e0dc7849bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891164, "uuid": "835e54a8-42cb-4347-af8d-03a020f18572", "value": "T118B49D01B6D2C1B2D57654300D26E775DEBCBD202836997BA3DA0D57FD70180AB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891164, "uuid": "42d34fdb-7281-48c0-8003-6b09745f5600", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891164, "uuid": "6b762ba8-b6a0-4d75-8f4a-2ec1df81512a", "value": "12288:iN9WLGVGUYcvqvvCNQzvCZQBm+sPZ6WSw:iN9sGV5YYqzvCZQBmtZZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891164, "uuid": "73e5cebe-f2d5-4c58-a98b-d1c0cc83ed0a", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891164, "uuid": "fa90d420-267f-4db7-985a-4390a07276c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891164, "uuid": "5e9fa16e-bad8-432f-9501-9bfb65902226", "value": "1104f14d6b21fafb2136ce765897498ae414a71b28382bc3de9365e143d38d11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3486afb0-daa6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906782, "uuid": "a8159240-9486-4c99-9ba8-1cdaa4750144", "comment": "Malware payload (Mirai)", "value": "26a2975ff57324f857096779a4dfc1b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906782, "uuid": "81b96348-c995-4e47-b928-46a0e75a4697", "comment": "Malware payload (Mirai)", "value": "110cd7107f10309b306bf0b7f25d5c458f39d9cc01a4be9063670d65234f6b7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906782, "uuid": "fe220531-2967-40fe-8186-528e669017b1", "comment": "Malware payload (Mirai)", "value": "b63969ad28995ea51c5b5ee120830015d87c786d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906782, "uuid": "d67f2ce4-aef1-4115-a2ed-946356cf02dd", "comment": "Malware payload (Mirai)", "value": "afca075e79f7b9e1e89986de6a3ae45c2b3fda9dc1726ffadb1552de45d448a5bc0d39043e627f82fa88854c5880a46d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906782, "uuid": "12ff2b2d-5e6b-4aac-a3f0-72c7167dfca6", "value": "T100B33D87B31C4743E0524BF6AE3E27E88FAE6D6051E8BB8C241B36094677C764445EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906782, "uuid": "62e2a6ad-df78-423e-8f09-b32a91813a82", "value": "1536:YAY1kEf+4sKyQWp1skP+nj3EaSdBsivZVKfwNL38nTo5xEEf:01rsJt1lmjvasiRKw8n85xEEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906782, "uuid": "108014bf-957d-41c1-8d80-6da13e2ac94a", "value": 117652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906782, "uuid": "9e3535c9-cbb5-4712-8747-eb1a05a9b388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906782, "uuid": "50c195e2-dfba-469f-984b-d21efdefac4f", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b2f4b9-da16-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765845091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845091, "uuid": "1538e476-9d0b-4a5c-8370-3603ed900f2e", "comment": "Malware payload (Gafgyt)", "value": "99a3310c06dd79ae0c1d8a0cbcdd4dae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845091, "uuid": "b538dd02-d6ae-4e16-935a-c239a5bc905f", "comment": "Malware payload (Gafgyt)", "value": "1140696a8fbbdd7412841cb1f12b1a04537571110bf435e39b95d21a512b0330", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845091, "uuid": "690ec559-cd5b-4461-bce4-67d16a3d673c", "comment": "Malware payload (Gafgyt)", "value": "eb94a3a865f588d8cb07334a3a418b65b12b4ed6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845091, "uuid": "276f74ce-b048-43c6-a136-86b72db3c464", "comment": "Malware payload (Gafgyt)", "value": "31408adbd3e388f12b4e0994bd4fa39a7dc272625d111c6eb502915498a5fedac741525658185525a2f940f2529e18ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845091, "uuid": "b24b3e1f-a4b5-4879-82d0-3da5e9cdc370", "value": "T18EA3F944BC548F15C9D0237AFE9F118C3B161398E2FEB52B9E106B95738A42F0D3AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845091, "uuid": "63e02727-304e-409e-a2f6-68801e21abdc", "value": "1536:6JnFxXlVQyYm2yJ6F1XPuGBKI8QsDOMv+uUbTG3q1FMn9/MkiEpBl1UvVns5F:sojSQGOMv+O3qWpBl1UvVns5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845091, "uuid": "357d1332-4986-45bb-b03f-6ffec5f00589", "value": 99704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845091, "uuid": "4634fd9c-896b-424f-abb7-288fd0a40015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845091, "uuid": "9002ec67-73e0-4be8-9571-b61b34835894", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d69d456-da97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765900355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900355, "uuid": "52050eab-5043-4a5e-801a-03c86a1d4b8f", "comment": "Malware payload (Mirai)", "value": "3fad06076484a16c6de6c1658e934f48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900355, "uuid": "53cda992-6bc8-4ba9-8ab2-1c9226ffb765", "comment": "Malware payload (Mirai)", "value": "11719bd1cd80df1782d42e5dfb9e06a7c8ad2dfdec34cdc32b8432a74c616073", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900355, "uuid": "130833f1-37c8-402e-9498-b87bf0020fad", "comment": "Malware payload (Mirai)", "value": "e67a8ab80a365adc3d4b594a368c21e9c5f42e47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900355, "uuid": "e3bdf48c-c9dd-4f65-9c87-23bb10eeadb2", "comment": "Malware payload (Mirai)", "value": "619c1498aec53282b66f978bf49beb8aa63c0475dfe9c10e5e2df7f90379f083a878cdd73f36aeac7c7c1ca76f19b9ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900355, "uuid": "a79fae76-6343-4969-b4df-e0907b6d6df4", "value": "T141F3C4487F600FBBD86ADD7742E84B09188C614376A83B3539B5E904FA4B15F0AE3D79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900355, "uuid": "e95f553c-e4a0-49ec-b2e5-eb5e249bf716", "value": "1536:LsZ6xEx+U92Kt7+w0eYWhRUUo7lFaaePAfdBLSI4ySYoq9icPY0r6lXbuMAo8nTI:LsHYfKtSw0eLIFOoMkwu08n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765900355, "uuid": "5b9e7b67-f88f-4150-8453-0556783c43cf", "value": 159604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765900355, "uuid": "d74aa414-2479-4c11-a1ca-968863a83286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900355, "uuid": "b5d85b35-fb3e-403c-9fc8-2c103b2c6652", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f089e986-da97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765900655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900655, "uuid": "ea60eaee-e704-40d8-814d-33fa042ec5a0", "comment": "Malware payload (Mirai)", "value": "ffd10a91c91836850dd7a22265ed6194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900655, "uuid": "0ce5ac08-302b-4aea-a4b5-36793602ce41", "comment": "Malware payload (Mirai)", "value": "118b4d58661e693fb5b5f3601ec81efbfea27c42e9060107c657b68c2c690044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900655, "uuid": "1df0fcb7-c78b-48b8-ab71-b554232a1088", "comment": "Malware payload (Mirai)", "value": "ef86f268c22a98419fc072f8c7e25323be25ce86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900655, "uuid": "78b8aa3e-157e-42e3-915a-72b78724dace", "comment": "Malware payload (Mirai)", "value": "1cc0d704c8582de912042b4ebaafbb0546fe35a0ba82c1b1fc7e4f92339199257169ef1731e8daf1418da7119a215bf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900655, "uuid": "88d1d58e-c11b-473c-aab5-780da9359654", "value": "T10683D887B3184343E0524BF5EE2E67F4DFA97EE015B8BA4C181B2A0954B5C364146FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900655, "uuid": "2ab3de8b-a56e-41e5-bb07-cfedb9cbe521", "value": "1536:AKXNFqYOsYODwdTrY+DI2RWDSG5g8nF5QIl+:XFqzrJ6SGS8nF5QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765900655, "uuid": "1d37dfcb-b2fe-4465-85ec-041ed6417059", "value": 87856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765900655, "uuid": "4da4234e-4ed1-4033-aaec-aac2d0e5aca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900655, "uuid": "2d50001e-d13f-4626-b600-05f1154068fd", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c635703-da73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765884811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884811, "uuid": "69bc1c28-0293-483c-bcc9-62b9aab822d0", "comment": "Malware payload (Mirai)", "value": "b59f628b7ac6aafe1ee86761e217733e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884811, "uuid": "398140ee-a424-4efa-8ee8-9bef13ca3f2e", "comment": "Malware payload (Mirai)", "value": "1288d5e1cd135207e3aa01737b3868f3210f3e5708a80e5ff30080c9f4572f76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884811, "uuid": "72d4665e-be18-4cc9-b340-beab9ed58aa7", "comment": "Malware payload (Mirai)", "value": "067a810a970ec425a4f23da87c4f2e9538a82090", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884811, "uuid": "7665cd5f-5043-412a-b5a0-237ff56cf802", "comment": "Malware payload (Mirai)", "value": "136249f000e073264089850f9be80cb1146f7accdd5d3ff447f79a7671395dbff2b50fe292e5dbb8f568ac490d59069b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884811, "uuid": "eae59071-8799-43d6-acd4-13ba2e3b89ba", "value": "T117C33A31EC743E27D0E074BA51D38335F9A95B4910F88A1DFD620D9DDE3A0A4267B2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884811, "uuid": "5093eb5d-0e37-4cbc-a11c-adc9dda58b94", "value": "1536:ko0eSXKAsOunWa4OkYLLZeQKVW8mDRN80Bsim0fQH6bEy3btt233InxuE1E9JMq3:kl/AJWnG64Xr60oHUPXxtwJMIsNfjyBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765884811, "uuid": "076e8472-fdf3-4b10-9ac0-4497656e8746", "value": 125660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765884811, "uuid": "9504f21d-33e0-4516-9b2e-b8185205d3a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884811, "uuid": "727970ba-ca13-4ae5-ac9b-03314be825e6", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ebd41a-da76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886298, "uuid": "ce5bc30c-fabc-48db-9e2f-c2ac67e370e2", "comment": "Malware payload (Mirai)", "value": "2dbbac969474a3a4ab18daaddab712a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886298, "uuid": "6bd256c8-69b1-4cdf-a4aa-ab329e3834e3", "comment": "Malware payload (Mirai)", "value": "133098190ed63f0a08c92fc301ec7d5cd19fbb81e66fa0cf5b4c8e72a9e11fd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886298, "uuid": "ec634aa4-9456-4635-97d4-647e5b74a7b6", "comment": "Malware payload (Mirai)", "value": "41c9bf950c640502f03532de8c40a9b7d9a714cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886298, "uuid": "c03ecf5d-cc3e-4146-8827-24665a0e2013", "comment": "Malware payload (Mirai)", "value": "41a83a93639b62fccf5ac49b520a1274f2e7b0fcacb215a058f3c9634f1bc6ec9b22a12b0ce860e2b5c2b045366aea77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886298, "uuid": "6812ee2a-e88d-4475-94e7-e9d7967f02e8", "value": "T103A3E883B7098703F4534AF47E3F2BE8DF9869A0516CB74D281B63184172D72E946EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886298, "uuid": "1b2c55b3-d7a7-47af-a74a-7103a5ecdc48", "value": "1536:LavlpEqljeZCA+5HfRaacVjsKUT0QRzH5gn8ndo5PkT:ujeL+5Hf4VsF9Rz48nm58T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886298, "uuid": "353bc6eb-4280-4041-adcc-bbb30f466bb9", "value": 99604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886298, "uuid": "77f1275c-ea47-446a-a17c-4bf4e398fc77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886298, "uuid": "22c49c12-0185-4060-9016-7e1d11ff915a", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccb1ee4-da88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765893858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893858, "uuid": "cf1ce54b-503a-4d37-a636-f329d288f6f9", "comment": "Malware payload (Mirai)", "value": "96da364c288f6448db7c1b0578332751", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893858, "uuid": "42a1bc92-efaf-41bf-938b-daa199d4387c", "comment": "Malware payload (Mirai)", "value": "1341da4ccf04c54c64f500ac6e175ae259877d09ed7278b587fc05fbcd5e20c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893858, "uuid": "b5fe314c-18d6-4607-b6ef-36af4c4f54a1", "comment": "Malware payload (Mirai)", "value": "cd3dc4c26cf45a7b3998ef7f2721ee16dccffcfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893858, "uuid": "fc70a302-f85c-49fe-a3e6-17dd5ab82c38", "comment": "Malware payload (Mirai)", "value": "e3e1c7c3121b2a7a6c25144738b2a0e87edd107000dd4dbf8579e6b18f45bae02e82993eb4e194e4b233e07009e52789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893858, "uuid": "e21adec4-1503-4b50-aa85-b313ada12b21", "value": "T128C34B22ACB63E37D0F07ABA51D38232F1B5570810ACD719BD720D9C9E7912837576BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893858, "uuid": "f6c3841f-e734-42a2-9fa8-0bfd0b22f053", "value": "1536:ViwdXSLlbbhfH4nDEycw8TZejHVWv4MORo8L86mcGQtS3d2WiR0Q6LZFgAkA3XxG:VXMX04tiAcXr7p6YB0jABj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765893858, "uuid": "49fa6550-4539-47ba-8e5f-0858984874c5", "value": 124244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765893858, "uuid": "552c3b52-2030-4032-80d0-d499e4918362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893858, "uuid": "8e5eedb6-c1ef-4873-8eb7-e5a37208ff7d", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da7035c-da69-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765880733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880733, "uuid": "58dbff51-68fb-48eb-a28d-9f1bcb1d8c16", "comment": "Malware payload (RemcosRAT)", "value": "4cac93dd174cb12635401adf6a0def33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jblakibk-duckdns-org", "colour": "#0AB135", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880733, "uuid": "166e8d72-4e7a-4d79-9d4d-1bfe82870b0d", "comment": "Malware payload (RemcosRAT)", "value": "13be3d2ece86aa5694f7bacac71cf282438b59ab9ed0fe3b6d3bb6aa0d51fb1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jblakibk-duckdns-org", "colour": "#0AB135", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880733, "uuid": "2e07575d-0620-4462-a363-e9bdbd0f2f46", "comment": "Malware payload (RemcosRAT)", "value": "2049ebbd11156458cab9f74d8ca8ee8dff01dd94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jblakibk-duckdns-org", "colour": "#0AB135", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880733, "uuid": "f95d5e9f-e0e7-4cb3-bddc-d96ee2565767", "comment": "Malware payload (RemcosRAT)", "value": "dada97d72d874eb699d81fc4e3d33fa9caee5975010d9f9e6aafaf7181b737fbe11b07bf68f479647ca0986cc4247e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jblakibk-duckdns-org", "colour": "#0AB135", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880733, "uuid": "16934ca4-f9b7-49e6-8610-811839ef578d", "value": "T16C3512DF3EDD7300C51D2631885746D81B4A7EC89066E7882BB2746E8DFA2B8947E173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880733, "uuid": "f0226fb9-6c16-49f6-8934-35be27d2a4db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880733, "uuid": "df45d407-78b7-4c67-8fbe-eed9512f1ebd", "value": "24576:OpyEi2H9ejJzqpJI06EAXQTYs2t6KU74xdExQR:O6k9eopu06EAy2ta0xmxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880733, "uuid": "23f61f9b-e1e2-4cb1-88a6-c551fa29e021", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880733, "uuid": "7b46d494-35c3-4eab-ac18-5e98aa13e744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880733, "uuid": "5e3f9e40-4b09-4b41-8bad-ae5f57d0918f", "value": "13be3d2ece86aa5694f7bacac71cf282438b59ab9ed0fe3b6d3bb6aa0d51fb1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c4aa2a-da93-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1765898760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898760, "uuid": "adf2c2b6-41fe-445d-8391-8a0694c7ca6d", "comment": "Malware payload (ACRStealer)", "value": "91f73b7f9d664c04e794b2bf62de0428", "object_relation": "md5", "Tag": [ { "name": "193-33-195-12", "colour": "#AF8637", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898760, "uuid": "c7782bc6-f346-4c9e-b907-75b4df50cec1", "comment": "Malware payload (ACRStealer)", "value": "148071e2c945617372ee205c023b223b40519d546d991bd3c4dbcfdf60ab70ee", "object_relation": "sha256", "Tag": [ { "name": "193-33-195-12", "colour": "#AF8637", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898760, "uuid": "3a611098-8bdb-41aa-9e81-9bfdd98471b2", "comment": "Malware payload (ACRStealer)", "value": "f85fd59e09835fee3f08c786345cd6c7a01b0a08", "object_relation": "sha1", "Tag": [ { "name": "193-33-195-12", "colour": "#AF8637", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898760, "uuid": "0925c2f9-9210-4194-9e4b-395838821a67", "comment": "Malware payload (ACRStealer)", "value": "ffb752cb8a7096857d479f1584a4709f088724db8df16d7e694a3ab53a7bd256f2178eaf7551c513b30947b1ba9fbe9e", "object_relation": "sha3-384", "Tag": [ { "name": "193-33-195-12", "colour": "#AF8637", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898760, "uuid": "3e7e26a0-2010-43d3-9c76-6631a39596bc", "value": "T16545127AA3E01466D474B73895F197B75A31B8D04F2516EB2FC8913C8E232C8E972B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898760, "uuid": "7b8fda50-35ce-4978-9d7c-2775ad617603", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898760, "uuid": "e8c30158-4c74-4f6f-bc48-d0ea57e2fe96", "value": "24576:d6y0+LSfCayjs9T4eU92XAshcrIZKRbP51d+fSi:P5LGAjLKXa0kRDEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765898760, "uuid": "85244025-26d7-4858-bcfa-fbcc0ceeee48", "value": 1230336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765898760, "uuid": "9e7282ac-79e8-48cc-82f1-614c847a6afc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898760, "uuid": "ed2aed32-81ac-4c1a-9815-b7ebe5e9bb7d", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d0e11d-da7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765888150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888150, "uuid": "54f3b1be-859a-4c7c-8ac0-150ee1241e18", "comment": "Malware payload (Mirai)", "value": "2cf6711b6e5cbfcf67a16c2495f67cab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888150, "uuid": "707ff21d-45c0-44a7-a038-50e38246b886", "comment": "Malware payload (Mirai)", "value": "159d2ada9b359cbbff10e5c3c791f256b93f5d880860e2957c0ebca8aace109c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888150, "uuid": "2b785fa9-4256-405c-a1a9-9f2e7f9d3a30", "comment": "Malware payload (Mirai)", "value": "3a5b91b0a65ea2ce955fe1e6e48e8ac159d56609", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888150, "uuid": "571fc793-2933-4cfc-ad60-d24d654c65d8", "comment": "Malware payload (Mirai)", "value": "55c64d72fc98cd7365574fbb385bd2e55a5a24f55652aeb83ab120fc112123169a9250ab45f404c3adee304dc0645011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888150, "uuid": "84503992-293a-402d-a087-74176ffe88c2", "value": "T142E3C65E6E209F7EF2AC837487BB4B29DD5912923BE1C560E16CED005E7034DA41FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888150, "uuid": "aacc0920-c0c2-498a-ab4d-381ea1c9968e", "value": "3072:TbYHzRzj+JxfnhL5tf5tdCt32p0uAmZRgnbQyAKCNj5PlcTHkIaeODTO6jcKAsKM:T4zRzj+NVUPQxcPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888150, "uuid": "2c05e6dd-13b3-4df1-99e8-5c38f12106ed", "value": 151376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888150, "uuid": "1efeef5c-532d-4931-ba42-e98fbbd0314c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888150, "uuid": "0cfbcfc0-ce65-4f19-b763-28e1b1053bd9", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95900b5e-dad8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765928420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928420, "uuid": "ae6fd8fd-1e5e-471a-9b0b-78b55a215232", "comment": "Malware payload (Mirai)", "value": "e68f503012c66c8b71f6ed436698a7ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928420, "uuid": "e04a7f5f-2e12-4e5f-b5f1-a28eb8d5f6b2", "comment": "Malware payload (Mirai)", "value": "15a8a2dfa1cda5bee6a573076b861f44007eeb966b2850072525ae9d9f80ad4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928420, "uuid": "3c8603a3-672d-4fde-88a8-6a67d63cdc10", "comment": "Malware payload (Mirai)", "value": "b3b2206d26498219616791a1779824e56b8da411", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928420, "uuid": "bf8eeb92-74e9-4aed-becf-64d55aaf5ee9", "comment": "Malware payload (Mirai)", "value": "03065bf97b62f9395968a6ba0bc28c93ee198e10971a8e91d355bc7426a89e094efe2508dc0ac9a5e947bbb8d24de593", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928420, "uuid": "cf2424cc-b3ff-4443-bdc4-d87c02789763", "value": "T1AEB35A21FCB63D37D0D4A4BB41C38132E9754F492CE8C62EBD620DDE9E35560276A2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928420, "uuid": "5092b1ad-ebd0-413a-a233-ce9adfbe0eca", "value": "1536:tZeFeVWc/R4nwng2c9RkVGBZZItFDaBlRbsPshVjzWki70YZEJrYhjNouhABKtt/:fo8dzg2umfSll6RI8hjNEBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765928420, "uuid": "c4da7f80-ed86-4667-8634-5b4f8151d92a", "value": 108652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765928420, "uuid": "87181124-56d1-4db2-bba2-e0d0b8764045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928420, "uuid": "56c9e8a6-9447-4cbe-aba0-f442105c0d1e", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443552cd-daaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910674, "uuid": "1bc6e46f-a284-4ed8-8555-d07556acc228", "comment": "Malware payload (Mirai)", "value": "d0730ba68845c70f96242e82a806503c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910674, "uuid": "07a9a212-64cc-4268-92b1-efe5379b604b", "comment": "Malware payload (Mirai)", "value": "15d27398216a82a41b4520e03f611da609de59c29d27140dde695164e3908636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910674, "uuid": "1335ad75-19fc-4091-8265-e809e310a49e", "comment": "Malware payload (Mirai)", "value": "3b58031d2b3f9a0048eb222c051cf904f9f478c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910674, "uuid": "7714f312-74f4-4e10-aace-c5bf192645ad", "comment": "Malware payload (Mirai)", "value": "469df67ddc43b5483220ccd81ebf870345db787260817f4a6efa52dc9f9c64b49873964d8b8bf74da4e16314d11320f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910674, "uuid": "7b579cdc-454b-483e-a4b8-dea235d539d4", "value": "T1F7B3F856BC418B54C9D723BBFF0B528D33230398D3EF71179D14AB65B79A02A0E7A846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910674, "uuid": "7f3f3f6c-9c91-4756-a28a-7ddb382aa08f", "value": "3072:Id2tcWMug+ancNc//ZvGM0gILb7/Wyo6WVnr5:Id2mWMug+JNwZOM9IL//d1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910674, "uuid": "4432c426-ca3b-4815-9478-8bd8526a5987", "value": 108016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910674, "uuid": "77914878-45a7-4a98-9031-0359df963f5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910674, "uuid": "1cc33702-1283-4fd0-8a17-592663313e0c", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fa6392-dad9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765928854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928854, "uuid": "a535fb6c-8cad-4df0-9c7c-7a66d2113cf2", "comment": "Malware payload", "value": "85e70adfebe31be67a5b9c8a69b91e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928854, "uuid": "152acab7-cc44-4ce8-a874-592af7b78e16", "comment": "Malware payload", "value": "16516159da4d7a13989c3bd18f001380a1dc82675e3b5cac654e1a58fd5553d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928854, "uuid": "8ee3d6c1-170c-4e78-9366-e3146f9d872e", "comment": "Malware payload", "value": "96551102e81e5eeb2a6d07db49614ddf203ae6c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928854, "uuid": "3dc0a5c1-a27d-4024-b2b2-078f8e508e17", "comment": "Malware payload", "value": "8ad9890831427f78dcd076716d6e1c38abddb990333eba426a713f9fe3003be22bcc442c467cefccbe1c586d19a515e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928854, "uuid": "7e5a86ad-1602-4dca-b29f-e0d867bce65f", "value": "T1FBB3D90A3A61DBFDF59A823487B3CB74A6D4229126D1C389E29CD6181E343CE5D0F7E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928854, "uuid": "b68170d8-af46-42af-81bf-f5f3a30551f7", "value": "1536:Vnk3oinjdx28F592MOONZLQ//d1UMeGw8II4armCduR9GsPgvR+/FG9:VKoijdxXqkPQ5eGFII8g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765928854, "uuid": "502db053-1d8d-4176-9f31-00adc623f869", "value": 112243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765928854, "uuid": "9603cc1f-e92d-4a18-841b-5c7e18ed90e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928854, "uuid": "5c379bdb-df7f-45d3-94aa-ce1abbe1b078", "value": "b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd87df3-da92-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765898211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898211, "uuid": "f8c13ec3-713a-4e34-97bf-86efd463b6a5", "comment": "Malware payload (AgentTesla)", "value": "f86c16238153b5aff093a32f81bedf23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898211, "uuid": "0fe6f4aa-24de-4da5-aeff-a2b61dca3619", "comment": "Malware payload (AgentTesla)", "value": "16f89d294182f47f0844762e53503ac9a70b3819f300f890f457f7f60fe3d754", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898211, "uuid": "73c6c888-daa9-43a2-bce0-dbe6966e9b4f", "comment": "Malware payload (AgentTesla)", "value": "dd83d7b9d3ece15cec15e1fbdfce92c72e896d2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898211, "uuid": "cd890f31-5eab-421b-b168-51904625116b", "comment": "Malware payload (AgentTesla)", "value": "3a76e2f6df0e0df130dd4b83d1f879eb7b3cd0243c1de43cfcd712f27da33d99956619a7d3d24f9a65d0bca06413eb69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898211, "uuid": "a27a4d0b-9c82-4c66-a35a-6191008d0cf1", "value": "T1DC852320AE689E9F8C5CD33A10FEAF4AA7939FD5000A87D7334435418F94B56DFB1626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898211, "uuid": "66a143aa-510c-4341-974f-2f5bd0dae959", "value": "49152:B3VT8kGueOnEbU3NG3VT8kGueOnEbU3Ns:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765898211, "uuid": "35f0e4b7-65f6-4161-9940-0bc413c929dd", "value": 1853810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765898211, "uuid": "fd469766-a5bd-4354-a0d5-3526515440b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898211, "uuid": "d2ea8932-8a5f-473b-be91-43cf3a7a3798", "value": "16f89d294182f47f0844762e53503ac9a70b3819f300f890f457f7f60fe3d754.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5334bcb5-da49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765866891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866891, "uuid": "0387c6cd-3d48-4cae-98c0-500e9f90c8ef", "comment": "Malware payload (Mirai)", "value": "2d06ff9c0a86038a5c5f4a27e7e2cf69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866891, "uuid": "640e55e1-1e46-4be7-abe8-23ed3cb4fc4b", "comment": "Malware payload (Mirai)", "value": "16f9cba8cab24573e9e8bc9cbea2f4c3dd64b1ed818b991e5c4e3c9327661ab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866891, "uuid": "3670deff-7c5c-4e0a-8f34-33f461cbfc4f", "comment": "Malware payload (Mirai)", "value": "d69ede310570f4ac85f11a6324cb0134d76b5cbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866891, "uuid": "65c79829-84b3-4193-adcd-4d2c13ad5878", "comment": "Malware payload (Mirai)", "value": "bbb38c62169cd27c0d2858e485d485ac97a498b0202077d169384cebb271a455bc3fbbe4c26d3111dab94242c123dafc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866891, "uuid": "8b48abff-bec7-4215-b19c-98e617225040", "value": "T1B6936CC5F643D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA2511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866891, "uuid": "48c08275-0cbb-4a0d-b6c9-5d963f30d4c8", "value": "1536:xpmWc2AcighsZ82fJxfc1HD1mSsM8meUigBQ9TnkISGtAd/0xZ:xpmX2riED2frfiHhmLVUBQ9kVT/0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765866891, "uuid": "defe8840-5515-4144-941d-7e5dd5573fb2", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765866891, "uuid": "54b16290-cef4-4032-8a6c-e4bd3ad1cd8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866891, "uuid": "223c7235-70d8-4eee-a449-81c512124420", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42c1b7c-da66-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765879562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879562, "uuid": "0f978b9f-2750-4167-80b5-8dbb77421e7f", "comment": "Malware payload", "value": "14c8b8ec4718673bded6be4e0dfa9d79", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879562, "uuid": "6a9fb58a-fa6f-43de-8b87-cc5c1bb8c0e6", "comment": "Malware payload", "value": "175965a2a901a63030e392d26e350142f006d355f426a73100f46ce48ce0c5e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879562, "uuid": "0c4f3fdd-8edc-44d8-9a90-b5af06305e8e", "comment": "Malware payload", "value": "6cb75d039d2e841ede876b73576a64f38b5c5c31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879562, "uuid": "eb67e4d4-dbaa-4931-8a35-ac690186205d", "comment": "Malware payload", "value": "3f1a3130adf10624c14c37d93f34b2de59addad944fc33c132717688adb314e09fb18554e09db5d4e2a660f2444d874d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879562, "uuid": "9c709332-ff0f-41a1-97f6-ab35fba99d07", "value": "T113A3F83D2723E4A524E1BA662FE750F69A0ACC29518314712D8FFF14583EF34B9396E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879562, "uuid": "3d9cfc20-1f16-42de-ba2d-cab2c66018a9", "value": "1536:GDB7eKg20jEfrFrweqjEEZP0jAyVetyQ6BkQWJ+aY:GDB7b0jET5nqIEZP0TVetyQ6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879562, "uuid": "5b48f825-260a-4d0a-a451-408c53e357b5", "value": 100137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879562, "uuid": "94f0c58e-ed83-4745-a654-d93a5b3a0e4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879562, "uuid": "37e3e9e6-5bb9-450d-b2c3-972d3f176d27", "value": "invoice-1637482117.pdf (76).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7815bc31-da1b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765847196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847196, "uuid": "4140b778-fc65-4804-96cb-08e4acd28a5f", "comment": "Malware payload (Mirai)", "value": "c9ddbd71fda7abd2a35ef24a8a8c16a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847196, "uuid": "ab4c7a6f-ed43-4b68-96cf-db434246d13c", "comment": "Malware payload (Mirai)", "value": "176634e90514396f0d9ca60dc19f766e1b979241beaf7b2f99a90a6d50083f16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847196, "uuid": "3f733be8-0a2a-48ce-a1fa-31873fbcc979", "comment": "Malware payload (Mirai)", "value": "b7f9e2fab1a90cbde296e64cee116db10d7f80ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847196, "uuid": "82fa2643-eb97-4348-995e-cce82c63e3f8", "comment": "Malware payload (Mirai)", "value": "b0aca9d42102eb1b97b0cc1634eb037e9f8fa18a4c0e9daaa2fcdae6d9e4358d31dd932ee3ff6e2c4a911f9f6e9ae94e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847196, "uuid": "6b3c1d92-e0b0-4207-ba16-ca297daf57a6", "value": "T1D2E3C70AAF910FBBCCAFDD3706A9064239CC651722A43B757674D528F54EA0F4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847196, "uuid": "c07db984-b95a-4388-8186-3a3928145b9a", "value": "1536:Jj8AboU6g5nncF6ETy80OIX+c5GkjN3XDTei37jk8wK0NANRLX4g8:JFbO+nIRklXDB3EvDkX4g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765847196, "uuid": "49e429e8-6992-4125-a30a-09c1dba7d446", "value": 148448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765847196, "uuid": "5607ea5f-0a99-4298-9816-34dee5894e23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847196, "uuid": "c0dbd7c6-2127-4a19-9803-eb3c19706a24", "value": "nuklear.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152e1490-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926916, "uuid": "2bee330c-d629-4d52-9c48-fa5bce61c32e", "comment": "Malware payload (Mirai)", "value": "517f93daff3e42cfd7d365ba26d97615", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926916, "uuid": "b845d7b3-24f6-443d-a17c-aa3658695f11", "comment": "Malware payload (Mirai)", "value": "176a26e5459096b35904e40291666878f6244ff25a8ee0710a35eb05454997ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926916, "uuid": "e6e3c0f3-d45e-4fcc-9bc3-fc0b8e1c0663", "comment": "Malware payload (Mirai)", "value": "bd999e820e950cd91ef428a2c1296e80a510af13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926916, "uuid": "5b41eccf-26fd-489c-94da-e42b53c8c17e", "comment": "Malware payload (Mirai)", "value": "2dd89218a8751ea252bcbd5f8b99a37617616929ebda596073de2b0eb268d652fd2afc86dbcbec2cc8e0405a62425fd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926916, "uuid": "75273ca2-29bf-4e07-88c7-e82085a71cea", "value": "T19EC3F6487D419A12CAD72ABFFF5F029C332613A8D3DE7107F8246B6973AA0174D3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926916, "uuid": "9f1cc6f9-8be9-4cc1-9430-a90a01ad7d26", "value": "1536:KwrK1oeLT+kbXUK/D1F5uUTt2FDzz34OWcW7CivV8kdeU+lx6Mm0oIvI8nXhVR15:KwGio4UTt2Ff1YvGkdV+7TouI8nXz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926916, "uuid": "c41308e3-8f60-4a92-a65a-1417696bee2b", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926916, "uuid": "8f338859-8b73-45f9-964d-b5bfcc671c70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926916, "uuid": "74087a90-ce02-4302-bff8-d4b9b5411a19", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a67ba95-dab2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765911973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911973, "uuid": "c1220ea7-9de4-4b42-8bca-e2ca34885a20", "comment": "Malware payload (Mirai)", "value": "f1857a3be69683d7846baa3f309ed46d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911973, "uuid": "c8069c8e-46cb-475d-8faf-c62bd18f3b1d", "comment": "Malware payload (Mirai)", "value": "181586d89fee0588c5882217ee4fbbd7db009f07029f79819f66de8d4eac81af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911973, "uuid": "0258dc61-5a7c-4962-b5e1-9ae6c6036e8d", "comment": "Malware payload (Mirai)", "value": "75ca956eb240313f67f45ffc2e7fdbc8dba00626", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911973, "uuid": "6cff6303-9f03-45d9-88ce-9d964bf892b0", "comment": "Malware payload (Mirai)", "value": "ae1cb0a2ef48d6ddeadafe526c796786de8d06d527c599e94dcebfe48df91e28b2f0521abcb723079df781e7d32e088c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911973, "uuid": "65e3613f-ad47-408c-b748-809414a83801", "value": "T1F7B339C16000CE7DF60BD67AC5A74E15B954E7518F920F2BE5A7FC93E92A0D4382AEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911973, "uuid": "d595e1bb-0d25-4f80-b893-68e44bb76b45", "value": "3072:fAn8LEy/51wDiV6ATci5aUMXADT4UD6MD:XwS1xV6VUMQQUD6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765911973, "uuid": "86c73a7c-93de-49d4-ad95-ada3e9e47e1a", "value": 111584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765911973, "uuid": "d03006e6-b383-43bb-874c-c1bf1f468a77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911973, "uuid": "742b9328-322c-4829-abd0-2c63790c38dc", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67944b2d-dab6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765913740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913740, "uuid": "c605726a-5d60-456c-84cc-60eb268db171", "comment": "Malware payload", "value": "ff2151342173223aa824478fcef45417", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913740, "uuid": "f017467b-e8a4-4c2f-a5bc-a63660586bd3", "comment": "Malware payload", "value": "182393bda7184333dcf922f0814a8d3b91744e404e9097f9552b8d4a4201de04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913740, "uuid": "4af7a7b6-a759-4f61-96d6-be8a7150bb73", "comment": "Malware payload", "value": "f21ae55deb1e95d3aa05a3fe16c8db0642530f81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913740, "uuid": "a0f2fd69-d8f4-4a97-aa81-b6321f704e0a", "comment": "Malware payload", "value": "0f39385e012b9d117ab70daf8469716f09ca81fe45bf67182bb703c54263e3adf3cdc4686ef048427fff4ceab737d059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913740, "uuid": "98c71db0-253f-4204-baa1-9a706832cb6c", "value": "T1D596335BB2AC03EEF9A5C23975708472D25ABF171B15C593B2E4CD6E0D236CC1A263D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913740, "uuid": "c17fbbe8-9d71-4751-97a8-2c4ed7dda7b4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913740, "uuid": "91ffd231-e953-4f64-8160-98c105923d3b", "value": "196608:LCugl7cQIurHmoFP/XRL94GG2NTsj+lOnOO:LCuEIuCAXH4GZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765913740, "uuid": "82ebd56c-b732-402c-abf0-98bbdcb790df", "value": 8789208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765913740, "uuid": "e1714451-9bc5-4353-b52a-358a7ca75a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913740, "uuid": "68008458-41f8-47b8-a329-127ce3ecf6a6", "value": "Order_024771.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c300336-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765896004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896004, "uuid": "8e0e6b70-f186-4698-9b65-9a0d7d7f01bf", "comment": "Malware payload (Stealc)", "value": "eb6cd00fd418fcca8dde7a197a097abc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896004, "uuid": "fee20f61-8792-4f84-9b67-7ab286aa4593", "comment": "Malware payload (Stealc)", "value": "1871c88c84a7e8b4ef913a22f6c3a5d75838be8c0ca5c2b1cb05fe01c61f118b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896004, "uuid": "74f0679c-9a2b-405c-9755-ee6ece3465b2", "comment": "Malware payload (Stealc)", "value": "9a4ad8082b7e7968376c05574f0870a56bdb786b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896004, "uuid": "3daf1f83-9373-46c6-ab3b-8871d3d43b4e", "comment": "Malware payload (Stealc)", "value": "8ff76f1a0a0ac270e600d45db34cca4530f1762220189e849ae4892e0f0456f4ae0417b13e73e9aa50d08d0bf0720b9e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896004, "uuid": "a7f9e0f0-a51b-45ee-a449-26a3d8323b05", "value": "T1B4964CD359A086ACD5AFF238E6A1664272387C0C477125D35B9336A51F33BE4123BB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896004, "uuid": "3bac77a4-54a9-452f-a9fd-cef1584057ac", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896004, "uuid": "c3cd84ea-ee21-44b4-9406-f325909b18ab", "value": "49152:gcEiLXnIRWxYkLnDX+Y0bPnanXpLcs+yJs/CKc7JGIHLzSIG4yzNAf11IEFq9ZmD:gkhyInyBAf11IEs9ZvZ9jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896004, "uuid": "ea4c90ff-9d0d-4647-85a2-d52a3b7451a3", "value": 8861352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896004, "uuid": "6fe0dc2d-4001-4a76-95cd-f807df4ec201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896004, "uuid": "90473d5f-0797-473f-85a9-275f66dccd7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21b1d7c-da73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765885062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885062, "uuid": "11f90d21-e9bb-4c02-94a8-8b261c055f19", "comment": "Malware payload (Mirai)", "value": "bf646c6c13da3244213dccbae36e205d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885062, "uuid": "0a4d18cd-ea6a-4c98-a05f-733ef4f113ed", "comment": "Malware payload (Mirai)", "value": "18b98f185468366511f5375d7e1b373e02f5969e350d9cee0b855fd748757c33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885062, "uuid": "02429796-6c60-48c7-a496-882cfe9c9dc7", "comment": "Malware payload (Mirai)", "value": "02c94c62b9b7726bc1f1e9a1b7f50e13fa132bfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885062, "uuid": "bcb28794-6e7b-41cb-832a-e4a81bcfb0d3", "comment": "Malware payload (Mirai)", "value": "5962b5b5b399d8d456582a22e8996ad5d627ba5257dacdb636cdcc7dd11fa5f4fdbb82624242818c8f04464c81ef0959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885062, "uuid": "e8033275-0126-4c52-947a-2460829e4915", "value": "T113C3189FB7184753E0424EFA6E3E77E8CFADAD6050B8BB4C241B660D01B6C365445ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885062, "uuid": "3fe2f37e-c498-4ca1-bcf9-a0fe4feffcb3", "value": "1536:Sk9ZbePC+k1wRz88zisUCZAXXT8sso5mWHLxTy798ndo5l0Al:35wRzziWZAZsXIm8nm5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885062, "uuid": "8f232e11-b0ef-4709-af5e-5795f3b54085", "value": 120100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885062, "uuid": "328ff0ba-6e77-4f78-8f69-086b6cbb2326", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885062, "uuid": "8ee54467-172e-4349-a6ef-c22597912b41", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72672c7-da81-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765891191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891191, "uuid": "68db065d-eedf-46f1-9293-6fd9d5140a70", "comment": "Malware payload (RemcosRAT)", "value": "83014f047af738024215da0956263f74", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891191, "uuid": "ae88d865-57d8-4eb6-a2f2-8a5083f2cda9", "comment": "Malware payload (RemcosRAT)", "value": "19b2d59daa350ecacca856db221fc7631f882872fa8021cfb6e7f1f20cc799ab", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891191, "uuid": "1f37e990-2748-410c-be82-06338e0207b0", "comment": "Malware payload (RemcosRAT)", "value": "2e30df6acd6a2c62991ca0957a19e6333256b640", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891191, "uuid": "869e96ba-57b3-4c5b-aee6-9423d1ae66a2", "comment": "Malware payload (RemcosRAT)", "value": "2d681a12eaeecf12fd7c0561141e4afe8e4a0b71efd2b91bd4677a7557eff3e3431dd0819a8f85cc001a99eac6531613", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891191, "uuid": "809c0bda-8b4d-422b-a03b-d79bfea3bac8", "value": "T15F05BE79F920BB9F82561282F57BDDFF437A3201AA12B13542D188C91E39F27C71D91A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891191, "uuid": "825f3227-342c-4908-9358-e49c67d15ae5", "value": "24576:hnA/PVRXqADAeXzyQgK8GVN0BWRmCgBdKyAj:FAVRXluKmUzSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891191, "uuid": "06949963-c5af-4493-b891-f36324215065", "value": 854486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891191, "uuid": "72b04589-fc2e-45e8-b7ab-280ef234d4cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891191, "uuid": "41213351-746a-41c0-8b56-84d4e2fa48e6", "value": "19b2d59daa350ecacca856db221fc7631f882872fa8021cfb6e7f1f20cc799ab.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d46888-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883354, "uuid": "fa58fde5-e80d-4a76-9cd5-1123178cdd96", "comment": "Malware payload (Mirai)", "value": "9e10c68b380778eb3748b204f3282536", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883354, "uuid": "6780ccc8-55df-49de-b53c-9b17dd491e83", "comment": "Malware payload (Mirai)", "value": "19d5c32038668abe3c2098fc3125e4760e8ac5b4cc651bf41abd23bef215fb62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883354, "uuid": "16c52056-d7e9-4948-b3bc-84c81d900857", "comment": "Malware payload (Mirai)", "value": "789b4b90157f7f456a31f33b474f8dd27478b126", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883354, "uuid": "38296a88-7c09-459d-aa1f-2d212d42aeab", "comment": "Malware payload (Mirai)", "value": "b649a769b57d5c7c70def891d1a2da86b43ef5ac6ab8191f1e781a2722725edd81eb42227b4c6c8429eede77a0895e42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883354, "uuid": "35fbc119-6edc-469c-a49c-9b803b2f5808", "value": "T1B9A30759BC46CA15C6C46A77FF8B4B9C331643D4D0DE7503AA2467B4739B02E4E3E889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883354, "uuid": "4ac27288-7ee3-4c6a-9594-0cab6c471fff", "value": "1536:G0iz4zQzzGTrmtPm2J6/X4Uz5/Ay8nX8VR15k:Gfz4zMKOm2J6/F5Yy8nX65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883354, "uuid": "3ed247ee-f826-4600-bd74-58119d2c8471", "value": 97976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883354, "uuid": "d1a1990e-73eb-4669-b03d-593319762383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883354, "uuid": "a7ec2398-28ba-41db-b17a-f1fba725c68e", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0decfc9a-da8b-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765895121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895121, "uuid": "f9347952-b287-4536-8c83-b2088c9ed4c6", "comment": "Malware payload (Stealc)", "value": "13a441a5373fcfcf2f614b49d19a69ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895121, "uuid": "20dd4614-0929-4124-8bb5-9f5c8a277015", "comment": "Malware payload (Stealc)", "value": "19f835c9e8d4fb7c88e482ead2a4fe2d0b990ab5444d1c4e42194bdb58e53b41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895121, "uuid": "0e81333f-f43c-4d33-acc7-6768f4718b2c", "comment": "Malware payload (Stealc)", "value": "7f0f92e1403ec47061f3fd4b3ee88376dc190ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895121, "uuid": "aba77911-a11b-43f2-84d7-f3470fa93178", "comment": "Malware payload (Stealc)", "value": "0c7b8c0dc697dd8af1a19ec11ece1dca30364b7fa349ffbabc194af7925c01c62122b750e6a0eea32e896ac41296af89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895121, "uuid": "d984961e-676e-43ec-99ec-b29c2053ab0f", "value": "T1A4B66CD29B604B75C5DBF239E49252C253B0B90A433925DF6A9126640D3BBC8133FB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895121, "uuid": "14ae277c-6d2b-4182-8833-3ef9e4e5c4e8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895121, "uuid": "61abc1d4-7738-4fa4-8012-7338bd3bffd0", "value": "49152:jhMLEyBlSGv1Oo6ngbqanGWI8A9YCSnhzCpsPY1bpNdfu7xOhyRSiQZalnElONSW:jZoQZae6MylD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895121, "uuid": "dc84c970-a186-4763-9c04-6787fdf8c016", "value": 10534544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895121, "uuid": "41074d61-d604-496e-8f06-f95c8f424b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895121, "uuid": "0abdf983-1a3f-43d6-928f-a23a1e18a1ad", "value": "13a441a5373fcfcf2f614b49d19a69ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781b59da-dac9-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1765921928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921928, "uuid": "2b2f9032-fbdc-43bc-ad7d-e184469970e6", "comment": "Malware payload (OffLoader)", "value": "87cd9e18c3f04e43f447e775d33e2153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921928, "uuid": "fe1286a4-a656-4e0e-929b-b3b44bac6b9c", "comment": "Malware payload (OffLoader)", "value": "1a5a3ca3568d8f54e8e1516454ff0336d4ae4bc092e9439a67c7321b70cbd0fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921928, "uuid": "f56ee1f8-3600-41d9-be66-7175bd64dfd6", "comment": "Malware payload (OffLoader)", "value": "d59d1a5b6a62fd8184af0f9735233013b05dec1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921928, "uuid": "6fc0005e-62b9-438d-a7e1-9963de584f71", "comment": "Malware payload (OffLoader)", "value": "22fd3407a4c096fce816a65f6883cc9d8a5d0aa80e41b129ff9d575aa6579e51e135a085b0c65b0fcdd5a5379214f6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921928, "uuid": "40ec3dec-a10a-4bb6-b1ca-d87107305eec", "value": "T157D62333B28A673EE47E1A3B55B696605D3B7621645B8C5296F00C8CCF2E0A01E7F753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921928, "uuid": "ed975bff-7095-45fa-82f0-0ae16e81fe65", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921928, "uuid": "2acad845-4026-4fcd-ae50-bb55cae9903d", "value": "393216:wK30zGgTu6iWUn8LW4aaEG7lIExT564Z7OHY:v30zdu1L86Re7556w7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765921928, "uuid": "60d6e476-b619-44aa-a7fd-4057b20ab3c4", "value": 13204657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765921928, "uuid": "b5952116-7dd4-4bc4-8e8f-789b862884b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921928, "uuid": "32f310db-d1d2-47b6-8a6b-a1f5ecdb3484", "value": "Yunxuan SPA Therapy Center Project List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1795dfb5-da9b-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1765902009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765902009, "uuid": "9dbcef78-26cd-4141-9020-63c504d303c9", "comment": "Malware payload (ValleyRAT)", "value": "059e25a8d69aed66bf13e46b9ca7e286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765902009, "uuid": "f997c1a9-72c9-4fb4-b757-5b9fdb02db70", "comment": "Malware payload (ValleyRAT)", "value": "1a7459f21ffafdad32a74c37bab2c625a1751ad3aadccfc147006177d044f986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765902009, "uuid": "596f761f-77a9-4729-b4da-ed4e3b02605a", "comment": "Malware payload (ValleyRAT)", "value": "660107d7d6a29d80d06c330c7a2f56fea90fdbf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765902009, "uuid": "9198356f-2935-4d77-84b4-39e684262d09", "comment": "Malware payload (ValleyRAT)", "value": "98fcfeec5a24871f57d9de121416ecf94ed7687f9f48bec596a34e584a0d6fc6289fb73398d853b66339adeca47bdce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765902009, "uuid": "63e1ad64-d14f-49be-826b-a0efd8769e7d", "value": "T113246B2272C0C233C1A319344EF6CFB15EBAF8721761514FA7D41B6E9E657A1EA3434A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765902009, "uuid": "e8412840-a49c-4104-b365-c95abc4d94c5", "value": "0e61d8a37c610264108dc54fdafe6b69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765902009, "uuid": "6d218bee-c86f-46ad-ab55-22fa362492bb", "value": "6144:W45fdZCYId0HRVL2AufJRbXN0BNMRBBirPVWKK5V:/fdZCGsACbXN0BNYBi7VA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765902009, "uuid": "3561b69c-bf42-4c05-b36f-d0ae922d5613", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765902009, "uuid": "f30d57ae-f242-4821-85c6-0dd55efd19b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765902009, "uuid": "c091b5a0-930d-4252-9ae2-0de2e7da0d18", "value": "059e25a8d69aed66bf13e46b9ca7e286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b27b123-da94-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765899009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899009, "uuid": "055b9f01-1e1e-49f1-804e-a4bc24ef14c0", "comment": "Malware payload", "value": "790a4841a2591b2cb4d6246977f7fa9e", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899009, "uuid": "8b0ef728-caf9-4ef9-a669-ab1d4dc29331", "comment": "Malware payload", "value": "1a8299a0ac0c810dd9323230b0e5e30d4e294d82237461738bfc919453bc44c8", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899009, "uuid": "ebe395c5-7d24-415a-8c0b-508787984a7e", "comment": "Malware payload", "value": "c247967e0970b4a167b717a85b81ecfada112399", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899009, "uuid": "1ff00a89-ff9f-420b-847a-61c83d5d43a5", "comment": "Malware payload", "value": "0c881c70189a7839d5f64d6750f8abe9226d11981c592a7593cdb99f0f5050dea4d7e2b29e000caaa4914f1ef50d5e7e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899009, "uuid": "53a2e8b4-39fd-4891-aa0c-f3d9174d8ad3", "value": "T1C5E4767A098646D6CDB9BE3BF0C8DB4BC9892008CE84B04C52D9AD55FDA7D78F63C641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899009, "uuid": "6e8b6056-ae68-4f4d-b16e-bb7340955102", "value": "192:O3fMWaMA3PsCUCX/5X2WWPCXqDP/JYP0XC5P3V7CcDGrI8O9CDrboo:yfLaJfofC6WFdjDGUW/oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765899009, "uuid": "18879825-dbc1-4e25-afd4-c352193e8a0b", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765899009, "uuid": "4fffd9c1-eaad-4d3b-89bf-3e02ffe3ce21", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899009, "uuid": "bbe6f9c9-4937-4bf6-be6f-6d9077fefc17", "value": "nSolicitacao_Descricao_Mercadoria_AWB_PT-BR.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf4d6e7-da48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765866530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866530, "uuid": "1111a369-132b-4cb7-9319-c50af75819ff", "comment": "Malware payload (Mirai)", "value": "e1f6f1618d60af01a2b601afd1f8ee69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866530, "uuid": "94992769-9dd2-4947-a3c0-c92d92c1a7b7", "comment": "Malware payload (Mirai)", "value": "1ad16126b09c5b7167006b094c4ac676b9f10b962d62203b8075875c81251a57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866530, "uuid": "d1c9e91f-dcfb-4f4e-adbe-6cafe78f45e8", "comment": "Malware payload (Mirai)", "value": "3c4a6c68f75563be6e59b38864190f7b9c2b9a60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866530, "uuid": "18f04a90-3f78-4787-80d4-5c50c5ab994e", "comment": "Malware payload (Mirai)", "value": "0c54a6ae5956bba6194e332a04fd723572af91c38df8948637f3a7dc16e144f5ae0630bc28c835769b88287a577ba9e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866530, "uuid": "fc300008-164b-4083-9810-98f15cb92e94", "value": "T191B34A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866530, "uuid": "aae87224-3018-4b9c-83eb-85e1d5aa46da", "value": "1536:1a97/6/q0AmnClzL9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/zB:1y6HClzZn+MCISxPKO8WL7t4LbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765866530, "uuid": "24e0458b-62b0-4fc3-bf3b-9f9aaf08c43e", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765866530, "uuid": "d3c63890-ad6a-40f6-8ca9-1af67dae5577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866530, "uuid": "a35c7757-8fbb-4d78-a887-47930819c11d", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5304abb-daaf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765910917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910917, "uuid": "2b8c6467-0f36-416c-9a66-4e10cf599148", "comment": "Malware payload", "value": "0adbfcb30f8dda5b06ee519a1cc0248e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910917, "uuid": "c745f57c-289c-4118-9ff4-fd2bde88ef62", "comment": "Malware payload", "value": "1ae0425b99d3302b64987d6795f36659eb8887c6a65ba974bee2ea7613526127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910917, "uuid": "da7894b9-5896-47fb-ac8a-70c0e733e743", "comment": "Malware payload", "value": "c9c30bd0e68649ef85aaea639d873b218ca0a111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910917, "uuid": "91a84475-9831-4adf-b449-4876d4d6cd81", "comment": "Malware payload", "value": "b0de188cfa6776e2fff75baca640ee7a524e2275da519b08c03b6e10017d4599842c742174f9bc2e5722e75f3c9e51fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910917, "uuid": "9db03062-93f0-4c8f-a9d8-adf0a3276cf2", "value": "T141C33A54BD419A12C6DB667FFF5E229C332613A8E3DF7407EA202B5973860271D3E909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910917, "uuid": "129de347-53cc-4f3c-964a-a0a15bc5c940", "value": "1536:MvM2mcKaw1dkD9GSSt2gjTwtvpzzCeDLt4za7cLC0t+R5gsWxmvp8ndo5:MvMNPR1jTwtvx4zycLZcRyHcp8nm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910917, "uuid": "1f668029-0beb-4d6a-92e9-fc2fe80e4f1b", "value": 121816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910917, "uuid": "1c1b2c7d-81f4-4c62-871d-76be24e9389f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910917, "uuid": "7ce1c85d-79ba-4e78-a0c9-7299c44ed48c", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24f6c72-da5f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765876580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876580, "uuid": "b08f60f6-7fc9-480c-bc3f-b1b5f2601b84", "comment": "Malware payload", "value": "25f23ff493b368efbf5699209c413b70", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876580, "uuid": "31f8d967-8c74-4502-a142-7144500f8fb3", "comment": "Malware payload", "value": "1b33493ea8a5e55e224f6801245fb277c970504971dd75c8b962e0e668e24e02", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876580, "uuid": "c5a152dd-7bbd-4104-8ee0-2ff593c84679", "comment": "Malware payload", "value": "222df8545a93919d8bd4a431649d0ec4376b1776", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876580, "uuid": "45e4d711-82a9-4ba7-888b-e2a9113ad47f", "comment": "Malware payload", "value": "7588f285e751c63958d54c407cc2e770e8f2908da04d84bbbacff121a9e46e16723f76095802d6e6715d201601c30c90", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876580, "uuid": "c55734b2-5530-4529-99cb-11b573ced767", "value": "T1F0E3524B4D6F48EB43DA5425490F5D06CBCB4613690DD8A43ADFEF8B6F21EE0A0796E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876580, "uuid": "276786b3-2486-4e52-8b03-a5bec5dd6bff", "value": "1536:RAVWK37pvV6Sg/r71ga91iXTS9/FvhUIoHKjjBem68sHoXtk42Nbbv4M:Fga91iXTS9/FvtoHHue40bjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765876580, "uuid": "e88e976f-7a55-4c06-bb06-210daafbf05b", "value": 151490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765876580, "uuid": "fbb4e812-39cb-4c26-a195-59a05e60b413", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876580, "uuid": "8fe2a662-74d5-4267-adf0-bc3eca3b88c9", "value": "France_Photos_Alpha_255.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab879179-da88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765894097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894097, "uuid": "0511b5ef-e81c-4f5c-ace2-fd4ddcf00399", "comment": "Malware payload (Mirai)", "value": "efa11b7fe444909f00268d879b06ac45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894097, "uuid": "9551417c-e5a4-412f-9a32-47ceacf3ea2c", "comment": "Malware payload (Mirai)", "value": "1b3c1df3864c26b142acce88d49f11ddf2d585ee5b6ae5461f6db5e92f3ea09b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894097, "uuid": "1853a099-05e0-47dc-b85d-bf664c843bb0", "comment": "Malware payload (Mirai)", "value": "112836b2884e212a4f855e24c0e288088ae506ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894097, "uuid": "f809ae2a-0c08-4ffb-b38e-7e5bab297f55", "comment": "Malware payload (Mirai)", "value": "0f98a295ffa0da1a7bbdc8103756f48e7e935bd3c0a0e17e3bae51d5b30ef3d72a97e11a44b4a6053cf75b1b115b4878", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894097, "uuid": "fe3c042b-1b1d-4cbc-8bc5-6d4f467e627e", "value": "T11A9319F5DAA2D0FAE431803951764F338B39FA36019DEE8BEB655A304C512019B75FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894097, "uuid": "31d04eb1-f039-4aa1-b10d-f6236a1204e8", "value": "1536:CJA0F8z7fORGlFVp796UCSNilI3GAQxnkQeQJPJAoF0abaVeOgoDf:C20F6ORGlVlT0lz9kQeQ9JFeYBoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765894097, "uuid": "aa71ef23-efd8-4935-ad58-daa27311dbf6", "value": 97008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765894097, "uuid": "751bbf64-253f-4363-91af-0f6ddf1f66b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894097, "uuid": "abef05f4-4a64-4da4-977b-76e5296f41e3", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82038d3c-dad7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927958, "uuid": "58a51740-3bf9-4a40-b586-0ed98177123c", "comment": "Malware payload (Mirai)", "value": "dc5e76fb9150d506e8872ac6d7c588a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927958, "uuid": "60c5ce70-1de0-485a-928e-9faad2f68c0f", "comment": "Malware payload (Mirai)", "value": "1b6ad4221c28017d154d2ff0b93f33f4433c6443256c0e7e2e30d62d8a0306ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927958, "uuid": "32323acd-7343-45b0-9196-62ecc4551a2d", "comment": "Malware payload (Mirai)", "value": "bc44c802ac6d5186cbd48ec8c60a5386441955b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927958, "uuid": "e8b9b4fc-7fe6-41f5-85b8-f2e54fc387fc", "comment": "Malware payload (Mirai)", "value": "7de1e28e3418ed6ed749c2fade6f00ed9b5d9dff1704190d0c461615ada52d4507bb7f13bb0c1cb68345f732491c25ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927958, "uuid": "72715a89-2688-4c31-9595-edb1dfaee168", "value": "T14AC34CCAB318C343E1636AF56D3E27F49F9CA9A151B8BB49354B660F1572C724009ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927958, "uuid": "608c26cb-854e-4535-b4cd-8ab9c5f48cee", "value": "1536:P6WGiJ8vpdh8sJaUtSTLPinmAPxqvL90GuSyjd0zT8nXYVR15dIFv:1SnsTLFAQ9DuTM8nX25dIFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927958, "uuid": "4f090f95-8b6b-4636-8534-ce198c444bc5", "value": 121580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927958, "uuid": "2c249781-7855-431d-af8f-4d62641d9bcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927958, "uuid": "168a0691-fc4c-4743-a696-f8547c0c9a56", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185c33f7-da7d-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1765889126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889126, "uuid": "58643319-9d60-49c9-97cc-ffe35395188a", "comment": "Malware payload (DarkTortilla)", "value": "da5a7282d0c9c81c37f05fc377059971", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889126, "uuid": "b97eeb4d-9b95-4414-9444-ba3c7022494c", "comment": "Malware payload (DarkTortilla)", "value": "1d003c4c1145a5474c42d283a9c987e70c0e23615e92ca840330c8bfffc0568b", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889126, "uuid": "137f0db4-f746-4ec6-ad0c-54d29b7c3b0f", "comment": "Malware payload (DarkTortilla)", "value": "453a68715bd5ba5eb033610059ded2ee51eb6373", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889126, "uuid": "c6389285-c9d0-4bb8-9e33-4b055f6ea509", "comment": "Malware payload (DarkTortilla)", "value": "f67072a16b37eaf35552984f4dec7ad99b2ae46bd3087d67b85e98044044e26b27be5f51a00f0232cdb27e4ee068e48a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889126, "uuid": "3c4eb84d-9bea-49d4-ad36-9c7dbfc88c14", "value": "T1CE45DF2523F89B74F8BF7B749570052087F2FC079D26DB8D998898AD7C31B819A56323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889126, "uuid": "64449641-aa9a-471e-93ce-33f91c1d0b0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889126, "uuid": "c70d86a3-f640-4382-b145-7ffb533d9367", "value": "24576:olEiPlztwt3DlyqgD1JTZl2eG/s2/72JBsPxaolpB:9t3hgD1wl/V7uiZaypB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889126, "uuid": "25fb1b06-0e5c-42c8-9685-d39edb90db52", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889126, "uuid": "3f12c497-7967-4f08-9a02-358ebb91b100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889126, "uuid": "ef6423cc-9050-4c25-8a17-32ccaaacbdda", "value": "S\u0130PAR\u0130\u015e FORMU 16-12-2025 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22c6c63-dab3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765912577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912577, "uuid": "a551fb08-7677-4205-aaee-7327136f539d", "comment": "Malware payload (Mirai)", "value": "4b3176a95ffaf5a91c0b752a4a558a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912577, "uuid": "0ef8496b-7f7a-4772-ab19-315c966d5327", "comment": "Malware payload (Mirai)", "value": "1d302106d0a8a218e9c715fcd3cc2104f372f03cd3948fc17f3621b9d7a721d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912577, "uuid": "6be9f8bb-8062-4b16-bdda-9e4e549860ad", "comment": "Malware payload (Mirai)", "value": "e97b7015686d8a3a5aa4c1622184525c26f36a96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912577, "uuid": "b78da8e5-6feb-4cdd-aa15-a4ed69d0623a", "comment": "Malware payload (Mirai)", "value": "1c914c0f74b55eef5ba6e49c8f58bb726a664f7cd072906fb1673e090c058ce92ae4757b2e05bdd6008e736c6856a13d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912577, "uuid": "a54f06de-7f97-4b39-8a9a-d713daf97953", "value": "T10E244C07F58080FDC5C5C1705BAFB63AE935B19D1238B6AB37D4AF123E4AE315A2DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912577, "uuid": "0d43ce83-c1b2-4cfb-9935-ef788c7a1a56", "value": "6144:foSw5WRPYiMNvTNDYmNwmwmqtJPCRYqqMZHGl0+9s:JhK2qfYds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912577, "uuid": "d092f1bf-d9cd-4b14-9e2d-2dbe2b338833", "value": 220816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912577, "uuid": "15345f1e-e7d3-47cf-b0cb-6bdd5f2918d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912577, "uuid": "e5a5aeee-3519-4885-ba0f-cded92ea187e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c50a78-da1a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765846846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846846, "uuid": "fd6d2c21-1b01-4f08-a67e-92860ad761ab", "comment": "Malware payload (AsyncRAT)", "value": "4d5c7f5cedeb44337b83f488fa8f3907", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846846, "uuid": "098f6905-b927-4dbc-a396-e1f4f9e4e86b", "comment": "Malware payload (AsyncRAT)", "value": "1d76631472db1ad1e222b5c59173d3820b670bdf30a11c1bef255c51607dd886", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846846, "uuid": "5359d436-67e9-45d1-90a1-59c4e5f14cf3", "comment": "Malware payload (AsyncRAT)", "value": "37a722366473799978e7778c1a9b9ce699b4cd94", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846846, "uuid": "65344495-a50d-4991-b20e-eb5a28a580e4", "comment": "Malware payload (AsyncRAT)", "value": "f2313bc60b36771fff79f2f6c9de24ef641ee207842fc190d69c488c49d05b24e1471685c8ef05a8ab05c483a5828301", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846846, "uuid": "14cffff6-ae32-4edf-baed-0f937d48319e", "value": "T129A33A407F75C249EBAD473644579271087FB9270823D088ADC11E3676BBF4ABD2B1BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846846, "uuid": "915eeed7-ac1a-4a35-b70d-30910bdb8152", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846846, "uuid": "0e505693-765d-4d3d-95ae-7cc1f2e3459a", "value": "1536:Mu1oVT1AL2tkBdUS3bzXSI+ETZ7dXpIy4TzfOMM/BQkZQvs:Mu1ET1AL2SBGS3bz+Ehntrms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846846, "uuid": "451b2bdb-9435-43af-a947-843878cf78a9", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846846, "uuid": "e0a07365-88f1-4f6e-8103-51870bba5877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846846, "uuid": "6c342bc5-369b-4fe5-a2be-e7a6c2f81c31", "value": "VisualCodeV1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0854e5-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765852784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852784, "uuid": "1da59218-454b-430b-bb2d-d2c23e8125a6", "comment": "Malware payload (Mirai)", "value": "4beb8b809a09aa6b14fe7945fd14852c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852784, "uuid": "c62c998a-e46c-47c1-8d4e-ec918adab20c", "comment": "Malware payload (Mirai)", "value": "1dc4a13c585d4f5736bfad5d5d0be2e4514490547c380b3f6180ac96dc5c6ab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852784, "uuid": "92fcdf9a-1a2f-4444-be5d-bb827e7a5575", "comment": "Malware payload (Mirai)", "value": "6255b8307b2fcfea3a7e6ecc9b61e4394d86d114", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852784, "uuid": "069ae37f-55b2-4fd1-9a3d-5d6c0d88d718", "comment": "Malware payload (Mirai)", "value": "fc01b416446ca5dbcbfcbb93b651eb97059a3c5b307ae052c21f4518e5d46cb3fbf500ec7010b719bb6a01ce24732039", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852784, "uuid": "4dc7892f-8829-441c-b3f9-05c39d005f4f", "value": "T1B9834C81FA43C6B3C8830BB6029B9F651931BEA51E1A9F46F31D7CF4AF124C87512B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852784, "uuid": "1719e148-6a92-4648-80fd-99e201882f8e", "value": "1536:MW9UfE0+jisRQ19Nnt/O3TWKK3rEznKEyin5MmF+bVYz+UEcf/31:/UfE0+jiUQ199tkqX3QKEDKmEbVYz+Pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852784, "uuid": "b46a66d7-e90b-4f72-ae16-92856a425173", "value": 85095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852784, "uuid": "d3d699a2-3e04-4e0b-a630-d570b1e09543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852784, "uuid": "27542dba-f4e9-4e9b-a4ec-f16286b8da28", "value": "Fantazy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f936e8b-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879662, "uuid": "fcb9e783-baa3-4bf6-be0a-975edfc39640", "comment": "Malware payload (Rhadamanthys)", "value": "01f16f3f6e30ea22996464ad519b00cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879662, "uuid": "a9bf6677-8bfd-4fce-afaa-a5d3f9879de8", "comment": "Malware payload (Rhadamanthys)", "value": "1e701e6b498f11d3c593f4755d137de0e75c1f8207ad1e7ce3c88c22b04c5b8a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879662, "uuid": "350a2f22-2cb1-4ccd-ac32-a35439c6145f", "comment": "Malware payload (Rhadamanthys)", "value": "1ad13d85d3c80ab3ffc2ba42c14f99f585ede626", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879662, "uuid": "2fc52db2-3442-4cb5-9c5b-1f306bf55862", "comment": "Malware payload (Rhadamanthys)", "value": "d65f1775ffcc6b359b30a08a39f0d09ac78a55ccfeec242fb1be460c44024b9cf91b6f960119bc9dfac4ce1a45a1d184", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879662, "uuid": "7413c6ed-0a97-4563-845d-8e5e176f56ff", "value": "T1F9A3D7713B33E9BE56BA729F2D33B5B4EC1AC836462D6147604AFB444C0814E6CA4FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879662, "uuid": "8973dba1-d8db-4cc2-ba7a-e375c8debda4", "value": "1536:GDB7eKg20e6Rr3r9N/Z+W96bhA3s1yMq6BkQWJ+aY:GDB7b0e6hbX/8W96bKs1yMq6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879662, "uuid": "b03fed7b-f872-4e89-adaa-6629c9f992b4", "value": 102072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879662, "uuid": "0f71bad7-541a-4bbf-b3d6-64f838e3b7ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879662, "uuid": "420c4f43-8e11-46cd-bb60-8b5d9422f088", "value": "invoice-1637482117.pdf (61).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dfbbcb-da95-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1765899586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899586, "uuid": "085d9922-3ba1-4777-b3c2-aff4f7906a38", "comment": "Malware payload (Efimer)", "value": "9b6424f8c7f6e7a3837334045cb6352c", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899586, "uuid": "641e8290-afb2-46f8-bc39-1d1412dea2b5", "comment": "Malware payload (Efimer)", "value": "1ea9906861a5b8d4bd30c42805d0f98a0d49c3aa227507bb0097227a94ade6c4", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899586, "uuid": "aec6ca9d-3582-408e-a658-cc8bb25f0fae", "comment": "Malware payload (Efimer)", "value": "fe11f70ed47d642c24db0444fbc2628cf22167c1", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899586, "uuid": "bedb8b8b-3d9e-4f3a-8c7a-4e8e8a043125", "comment": "Malware payload (Efimer)", "value": "d33980d66b7a32f941063087799acedbef53d773e1c4e3824cede51e4bad296dc2a4e5b935eebeceafb9ec70f774f315", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899586, "uuid": "bd5bf3df-ec29-4f42-9ab2-1ffa6e0a9658", "value": "T1D7D633482AD112EEEDF3C03DDFE69152E6A4B8750771CAAF87E442918D435D08E3EA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899586, "uuid": "6ad7e813-aff3-4386-982f-1216d0f3127c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899586, "uuid": "fd95b398-218a-44d9-b4db-6a0a12341943", "value": "393216:IXe/mbFhL3T0SjB3WP+6KXMCHWUjKcuI3/PjuUwk:IL5ZLeKXMb8nH/rAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765899586, "uuid": "7db9fcde-45da-4f4e-87e4-2da1467a66a9", "value": 12623906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765899586, "uuid": "33ca301c-7f71-4468-995a-2e1a3f01ef8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899586, "uuid": "bd440b23-341b-41dc-9c97-caff97b20b51", "value": "\ud835\udc1e\ud835\udc53\ud835\udc1f\ud835\udc52\ud835\udc50t\ud835\udc60_\ud835\udc50\ud835\udc2b\ud835\udc1a\ud835\udc50\ud835\udc58\ud835\udc52\ud835\udc51_\ud835\udc2f3\ud835\udfdb6\ud835\udfce_\ud835\udc58e\ud835\udc2b_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60da09c-da6c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765882196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882196, "uuid": "babb672b-ed79-4f5a-8c19-370c17647bc0", "comment": "Malware payload", "value": "027c83b5dc774402f6ee360ee6a0e5af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882196, "uuid": "aa4fc007-0737-46ac-b99a-138509ba03a1", "comment": "Malware payload", "value": "1eb91af4713f2151d4ade415d45fba925853b6d8a0eac90a75c69ee2b24088d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882196, "uuid": "0f23c856-407b-4790-b0c2-70e57505070b", "comment": "Malware payload", "value": "b5d59f5e393577f450f2c16daa803be4095341b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882196, "uuid": "21ac4018-13f0-4fff-a876-ea9242bcdfc3", "comment": "Malware payload", "value": "fd04223a6c9a4d7001cbbb9080ece5caa16b446ea0cfee06d34e3275a8b8a3d247f639fb18c96af76393ee9e145c5016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882196, "uuid": "7b126744-8f39-4752-9497-952e61f7fb00", "value": "T196252326C23F7B71EA5935798B33F640BB7472C096C59C7CD37C94760EBA0588A88D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882196, "uuid": "f01190c0-685b-49be-bf22-ce81c10a28ce", "value": "24576:L5fYK2Y3FwW25NNaHyU3Jk3hrS71E7CEYqO5:lwC+W2A35H6mE1O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765882196, "uuid": "8bb250cf-da67-43c3-b67d-259b707fa089", "value": 1033268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765882196, "uuid": "1e2d8417-c14f-4386-8496-58969cab2d68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882196, "uuid": "a43395ab-ca04-4d20-a393-843113c8e6fe", "value": "y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1547db0-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916414, "uuid": "6be646e1-4dca-41fd-9add-fb0ac1e01444", "comment": "Malware payload (Mirai)", "value": "afba489ebfa5758aaa3593c547be43b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916414, "uuid": "6fda1f10-1c6c-4979-9a13-f688cb9826c6", "comment": "Malware payload (Mirai)", "value": "1f2ef3d8b5617798a2edf449e1da32ebe50de3a9f5d72d092a790ffe97c4d983", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916414, "uuid": "cb208e8b-6f1b-41ce-a9a3-7ebfc5201783", "comment": "Malware payload (Mirai)", "value": "5a61475fe096549a4174b66f5857da85ccfd492f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916414, "uuid": "a35d991d-8012-488f-9437-52ada0c64cc0", "comment": "Malware payload (Mirai)", "value": "f56f1a9accad8c3fb2ae82756fb97e588b9f77fa9cda415599b2bfd9ef8d78af189a450bcbe146b433fe7a0fae4b540b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916414, "uuid": "ae2ab71a-a3b4-4310-a6ca-3a8649d72007", "value": "T186735D46D7CBF9F0CD4106B8206BEB35D93698323234DFF7E7D9B657A952212A04226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916414, "uuid": "11ef2a3d-e444-4772-884e-93225649a61e", "value": "1536:7NKUBf1J2hoQYjSwScT8vAZNpz7hVS9QAkY8:7N11CYelvAZNpz7hk9kY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916414, "uuid": "b06f4e03-ba77-43e0-8853-2c883aa64fbe", "value": 74328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916414, "uuid": "283f325c-8298-44d4-be50-e0e017fdb1ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916414, "uuid": "fcf2c68f-c76c-49e3-acc3-baf2818e4a8c", "value": "Fantazy.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8b8eeb-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879634, "uuid": "1e815b4f-ff50-4354-a69c-1f2e28aa2ee6", "comment": "Malware payload (Rhadamanthys)", "value": "a2a21a4e83c54c9c95c1e0ae81f2b20f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879634, "uuid": "be720aac-b82b-4151-a354-7d74a2120e7c", "comment": "Malware payload (Rhadamanthys)", "value": "1f882ea6e98b7dd45c57633ad7948566699870344afd7df10cab3adff3912e4f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879634, "uuid": "902f221c-85fe-4e00-920a-a47c30dc4458", "comment": "Malware payload (Rhadamanthys)", "value": "ff17ce1408f14cac3c3bb8f4e5f3ee1da901d650", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879634, "uuid": "cd226254-efac-42eb-b6ab-cc1a9dc5bfd0", "comment": "Malware payload (Rhadamanthys)", "value": "8ab3160d0d3d2a65d60a923dcb2b579dd352486517c9db68dfb9273d9169dc58672ef8b4aade2492f5f03fd0e0713eb2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879634, "uuid": "01c3b392-bfd7-45c7-9380-2ab722d48bb9", "value": "T12D9328705ED0B5B088BFD756CBAA09B6949DA9042C83692B010F7F79130BA3E7E115F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879634, "uuid": "a73b0e75-2799-4dfa-9e5e-91997fc545f7", "value": "768:GDhd0i7J4sYKgY/CMNfWdBhvec1RrXw+rgGoBGpHYuncJAAzOXfw5SLAuAAroQWK:GDB7eKg20Rr9rgG6f3Alo56BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879634, "uuid": "66355036-ba64-4339-aaaf-401363a86e45", "value": 97406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879634, "uuid": "38e62afc-4b4b-42e2-84c6-e43d918402d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879634, "uuid": "3523aea4-9d31-4c7d-a9f3-9a9946faca0e", "value": "invoice-1637482117.pdf (65).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25dbd96-da78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765887237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887237, "uuid": "72004d39-b71e-42a5-88a2-39cd74970424", "comment": "Malware payload (Mirai)", "value": "7f9f7ed376c2b8490370bb05b40d8929", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887237, "uuid": "4ce41ed4-5522-4e09-bccf-8e7713fba1a8", "comment": "Malware payload (Mirai)", "value": "2028689345c89f069850f8fa9bcc47de3923a838a672b62d8491d648728cd619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887237, "uuid": "e5ba4055-3695-436a-93f0-17185dda7ca4", "comment": "Malware payload (Mirai)", "value": "2299c912d7bfba2c55ef8d614160849465bf312e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887237, "uuid": "8304d3c0-078e-423f-a6c5-e38d1aabfc27", "comment": "Malware payload (Mirai)", "value": "9fb115b8cb2d9098bf63268c5f7c856bce6f248534d23bc54c492296591e3f5f22967d333f9f635d139436f224e9707a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887237, "uuid": "68a01571-0416-4461-8a6a-ae101ee639a3", "value": "T143D3D7085BA15E7BD4AACD3741A84B4918CE994731BC3BB579B4E504F60A18F0EF3C7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887237, "uuid": "33e9b31e-6dda-4b87-933f-5f5cfd5e1528", "value": "1536:R63P6DsBT9KxC6sP8i7tNXBrNFaCSXjcSUoWnKJcGVEtKM18ndo5C:R6Rre0dwjcStD0tj8nm5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765887237, "uuid": "fbf87299-4ed4-4f9a-a32d-c40fd5da5bf9", "value": 135072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765887237, "uuid": "1420acab-60b2-4dda-aae5-513f195b1f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887237, "uuid": "696714dd-e718-4845-a9d8-e4e966d0ffb7", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4876c36-daaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910916, "uuid": "0dcfc7e8-c91a-4aa1-974e-538dda14fc88", "comment": "Malware payload (Mirai)", "value": "0b2ad27ccd1371aea3bc3a86fc186f5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910916, "uuid": "97645bf4-8988-4821-9db6-b05f16754383", "comment": "Malware payload (Mirai)", "value": "20b00c588873cb42148cce2cfe02b8e664c721a7796611ab668b804c06df25ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910916, "uuid": "827cbd29-c739-4741-ab72-bfb22621b63d", "comment": "Malware payload (Mirai)", "value": "4d798f338f02c8783eb536fad02551e683c099c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910916, "uuid": "21658418-6e36-4283-a7f1-2fe14a07e47a", "comment": "Malware payload (Mirai)", "value": "c9e27fa81f14f9250a01414d3b615e258b28c511911d8184f367c598ad3649f02920d069b4810cbcb0bf27d92e7179db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910916, "uuid": "d7511bdc-d8ed-4878-a504-18ab61eda007", "value": "T151C309457D418B11C9D323BBFE5F129C331613E8E3DEB9179C102B66B79A2270E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910916, "uuid": "f3149fe6-04d1-4802-bc23-76ea8bd1c0ec", "value": "3072:xWDpmZ/bpMXbj5SS8gJ73glwPmfhVnp53:xWDw/bp0jsSRJ7QliihB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910916, "uuid": "572a6e5b-ba14-4d46-a1d4-730edf9b0932", "value": 124096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910916, "uuid": "4af809f5-d672-48b9-bcc5-89a8460711ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910916, "uuid": "449dc975-d542-4377-8bdf-9b1222c3aece", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1922095f-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926923, "uuid": "598c2eaf-8670-4579-bfec-f303e88bff79", "comment": "Malware payload (Mirai)", "value": "c3629e05b3d5e3f0b4803d2c54ebc504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926923, "uuid": "a361c709-9ee8-40d8-b840-d16074cb35cf", "comment": "Malware payload (Mirai)", "value": "21ceb64e54a5baefbfaf0f6ce3c821a94655f5db3948817f9e9ad0f2e4b1c0fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926923, "uuid": "aaf711e1-4b10-4adb-ac86-ee4ebebf8d09", "comment": "Malware payload (Mirai)", "value": "e8bc51975c60deef89eeaf1e38b6ef7d4334c11a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926923, "uuid": "5876220e-bb40-4b63-bab9-412f0c28c24c", "comment": "Malware payload (Mirai)", "value": "d3054ab676ed310e739faf2229b37137fbd170d7d980859e487c608aa9035dc621d1566fd50acada6027fedb5b95db0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926923, "uuid": "60c75325-2ba2-4c09-bcc2-25b6cb340230", "value": "T1C8F3C5083B614EBBE86FCD7744E84B49198C654622B83B357A70E904FA4B65F0AF3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926923, "uuid": "c8d1a950-a776-4827-b0bb-788b18a5dff2", "value": "3072:YQPPTNen/zJXtnU1IHesYx5i88bmzLxkjDpImCwUAuihGpcGQpgeNwIlxSEwwTtC:YQPbstdnU1IHesYx5i88bmzLxkjDpIma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926923, "uuid": "5b6830ab-779c-4476-b0fe-719e856a73ec", "value": 163788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926923, "uuid": "c8395658-9599-46f2-af38-1b82dd2f43ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926923, "uuid": "4d3ec2bd-3457-4b4f-b369-d5e596b79a1c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2784d30-da7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765889492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889492, "uuid": "bdfe48b0-c208-4964-8bee-fe1a0676bc24", "comment": "Malware payload (Mirai)", "value": "285480b242f4ad8c823b3d316bd73f20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889492, "uuid": "842e17e8-5a68-475f-b1c1-3d6ce4bda3b1", "comment": "Malware payload (Mirai)", "value": "241a520feac09382f1e9dcbaba7c04e6eed6d039546faf89be0d29876753265c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889492, "uuid": "b5473ef6-1bd4-46cc-9cd1-e4a1584b1e25", "comment": "Malware payload (Mirai)", "value": "76d05dcb5f9a1db5f94848148bbff889ef757454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889492, "uuid": "e32feb87-b843-4b28-b351-dfc2222f94f9", "comment": "Malware payload (Mirai)", "value": "d3c57512d97f07b5e257b9733e97f9a16056ca09edfe7c1ec0ef1f87f87ea8c64eeec60b8bfc7341f18e833be61f2da2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889492, "uuid": "ff250483-3ff5-4fc8-b10b-7bde938a651f", "value": "T15DB33DD2FAD3D9BAE8250530202D57728634FA3D00FFDA87EFAA59705D6010286797BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889492, "uuid": "a3f08820-f2e1-40c3-866d-16eec4174c56", "value": "3072:juy7HgyyvdNv9YzBgdUYK1doXontELjwaoDUBB4:jX7svTlY1gdUYioxgao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889492, "uuid": "c8b7324d-cba9-4512-b434-99f5323dee62", "value": 116656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889492, "uuid": "87a7dc8c-ad71-4989-a111-800338cf9957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889492, "uuid": "85fc1a12-8664-47e6-a9bc-481831c2c52f", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b99dbd-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879538, "uuid": "db457e33-d4fc-499d-ad17-3cb193d8437e", "comment": "Malware payload (Rhadamanthys)", "value": "5c47e9a130dfb4d1b4a08283190a9d83", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879538, "uuid": "e6a1a7f8-5302-4a7d-a62f-ab75d12202f8", "comment": "Malware payload (Rhadamanthys)", "value": "249a88a87f50bdf65fc9f644150352ba781b1a19384dd1113b32c9601f7733ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879538, "uuid": "f88844d5-2361-4512-b495-cc623b01ffc6", "comment": "Malware payload (Rhadamanthys)", "value": "ca64502a34e5906e5e3d73212f3a8558d8914792", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879538, "uuid": "e0337a54-c716-43b4-8033-306f4ed02779", "comment": "Malware payload (Rhadamanthys)", "value": "7f6a4d7834406507c3ea2e7af401a3b12fd467727fc827aef8f988ec76ebe2aed54540ce4f2055c81dd6b164d1c4adb8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879538, "uuid": "42a8a814-79c1-4956-b89e-2859e71d2104", "value": "T142A308A45F72F69C112E7D5BA1A06CDEC801768B5497CB6488CEF77222EAF156380DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879538, "uuid": "baa80eeb-bd5d-493f-b4d0-c85707e86efd", "value": "3072:GDB7b0N5U5JfZR5h5gj5Y5P5C5Y5t5J4V6BkQWkp:0I41ZH3gVMhqMTC6Wkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879538, "uuid": "222944ef-ab7a-4c4d-b494-24ac9b18a16f", "value": 102788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879538, "uuid": "4865ffce-7f94-4acb-910f-d49fde502cc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879538, "uuid": "950265d4-7f59-4be1-826f-49958f617d42", "value": "invoice-1637482117.pdf (80).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa19d911-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883357, "uuid": "f515ddef-76f7-4506-8028-d71a40a6c9a8", "comment": "Malware payload (Mirai)", "value": "ef2af7b90c46d44ba873b06ef63340fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883357, "uuid": "4036fecd-a304-487a-b5a2-077c2e34b57d", "comment": "Malware payload (Mirai)", "value": "25ca9d487d4ceb208dec20a66f6075ac5381e6976ec9433329911c5fbc756f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883357, "uuid": "93afbc77-f59f-49ed-bf4c-fb9daeb5abaf", "comment": "Malware payload (Mirai)", "value": "4593c83614fd3084c5cbcc360bc2d436cbf5af33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883357, "uuid": "ff678bdb-8dae-4f73-8a49-6d427ca814d5", "comment": "Malware payload (Mirai)", "value": "df8cdf2e676031d27ed4e13103673d43783a06595831c85902541f1a7b8e8d5cdae21e6b62ab68d2084f5cdf0c9d8e0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883357, "uuid": "ad25f64c-1b60-4598-83dc-7b48881d5713", "value": "T100C32BC7B3194723E0524EF96D3E2FE8CFAD695011B4BB4C264B661D8176CB28446ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883357, "uuid": "d56e0837-51d8-4d7a-b508-ab4ffc8426ee", "value": "1536:6oArKHB/biHPS6BtcIniVAQa99jjHsP5ipun7wah8nX8VR15b1Y:yKFX6BtcIGObsAy78nX65b1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883357, "uuid": "a5b01d27-a40e-454a-9f2e-e5d4033add72", "value": 120716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883357, "uuid": "0f26acf0-8007-4dd6-84f7-45f0433033d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883357, "uuid": "b9ee8a50-7ee1-46a2-8e98-0f572cdbc000", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a344d10-daa4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906094, "uuid": "b4204a61-f1ec-48f3-ac61-c0ed6e5f088a", "comment": "Malware payload (Mirai)", "value": "3ddb0396dd6cf8fee2a8e0a51786096d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906094, "uuid": "8c4b2fd9-cf85-433c-942c-6e19ba94e3da", "comment": "Malware payload (Mirai)", "value": "25cefac9757fab33493fe23fed9a3757d435c0510783dabf596c010ee07afb0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906094, "uuid": "7831801d-48ab-4c65-b285-69942f2ecda7", "comment": "Malware payload (Mirai)", "value": "6bc2d68a694ec59247a1583ae697a21d532e0c2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906094, "uuid": "2d2c87a4-4264-423d-90cf-ef06f2aad94b", "comment": "Malware payload (Mirai)", "value": "d3e58e6fb0098d83412e454852a9ce5c09c1d968dd2137edbcca0bd08b83c5528ea8580f5c72a159da1036207b699906", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906094, "uuid": "032aa029-d69f-4a84-a09c-ab1cdc931ca4", "value": "T149B33A96DB93D5BAF425013191725732CA38FE3A006FDACBEFA499B1AC10201875D7BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906094, "uuid": "e35c39e4-9d9a-422a-bcc5-4eb35ee22c87", "value": "3072:PdOU05lLpTWCnSCalCOlJ89MYndtaZZXUeoD6AuUi:P0UqpCkSBlCOlO9/nXyieoGAuUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906094, "uuid": "5c3495b6-f548-47d9-8177-11c8e79dab55", "value": 115664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906094, "uuid": "c06935f1-39f4-4976-863a-7fdc02973877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906094, "uuid": "0685ef08-004a-4373-91d1-14efdcee61c6", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad310a22-da84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765892382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892382, "uuid": "790a0a98-9ea4-47a6-9554-3132ebc3fe62", "comment": "Malware payload (Mirai)", "value": "5fecd7dc7444c48c8e66c1d7644db993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892382, "uuid": "defa85d9-a374-471c-bef2-599ec176df19", "comment": "Malware payload (Mirai)", "value": "25e96d2b72b93cdae63e8fc8f09a003f169859264ce137ecac9d9d23e93ec6e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892382, "uuid": "fe63d637-2514-42e6-97bd-e3472c731021", "comment": "Malware payload (Mirai)", "value": "1e6ed264bb4b1a2fb53256471459a38ff2968729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892382, "uuid": "e252139c-3d08-484a-8e24-588d53f14c31", "comment": "Malware payload (Mirai)", "value": "8c19d9afc17de922dfbda81c2d20b5b72b3cff1aa981274ba13918b9d19d14d3994103bf7721f5849967251d8dffbf89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892382, "uuid": "8ff5714c-0d2e-49e4-9835-848c6c4aec8b", "value": "T17CA37D228015EEF5D18C0EB1B4916D7CEB127511255B9EBF7AAD80A040CFD5BFA4E372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892382, "uuid": "4b42faa7-0d72-4398-8e29-14c4264b7764", "value": "1536:VLSJY6VB838jmxk//DvwE1ZxxD9Jc4WoUM1hsSeCcDF3IgCaIV:VZ63Vyxk//DvwuZXDcShsSeBR7C9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892382, "uuid": "6ae8dfe3-6ec9-411e-b587-8be9a0f25d84", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892382, "uuid": "08470fc2-1073-4d67-aff4-c0ec7b2a2db4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892382, "uuid": "6b910765-4d63-4cfb-b2fe-cbcc76d057eb", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84744b0f-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873845, "uuid": "98825e77-0b3d-4105-8ea2-967e59068d05", "comment": "Malware payload (Mirai)", "value": "213e3b44ed094878e4737fd4931c29a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873845, "uuid": "33280435-b24f-4d49-bd5e-b3741ceffb8e", "comment": "Malware payload (Mirai)", "value": "27187ee10725de38744560c8da31a00dfaefb19d08fb476897c0427421ae226a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873845, "uuid": "7a9cd479-09d5-4f13-bf2a-77c54b2e20cd", "comment": "Malware payload (Mirai)", "value": "df1e0e846ea3044a93df4a5cd9f4ccd8f2bb67cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873845, "uuid": "5851dc22-4182-438b-8fe2-a1e7c8da4404", "comment": "Malware payload (Mirai)", "value": "e376d7b61c384ac6068fb3cb1a9a9ff04b053a1662a7cfa1b03f65458ea06d0fba97bce76bbfa54381385cc406362f16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873845, "uuid": "db80d6c4-cd76-4327-8ea8-2fea46fcd195", "value": "T113234B49CB03C1F0D8861570503BAB7AEE7A6C335570ED5BEB987A25AC32B21D50B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873845, "uuid": "add9646f-57f0-461e-b20a-a2761955b376", "value": "768:TYXn153tNknjKPbyS2NFG/AuT+ZO42/kJhjhm8ucuN7iKlUH1GLPOdq:TYXn1pEjKPmS2K2OBl8u5SGLGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873845, "uuid": "9400a302-4cd6-451a-9f01-6f93c5df3cb8", "value": 45728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873845, "uuid": "d8d48a38-1830-46e4-8294-bca41d251f92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873845, "uuid": "26fe8eea-050c-4676-a5c8-3700ae31e5b5", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61960f93-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879800, "uuid": "47122634-7b22-42e5-b443-492efa899c7b", "comment": "Malware payload (Rhadamanthys)", "value": "66b3f79b50391ed430f0e2a90651096b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879800, "uuid": "8b223a15-4eb8-47f8-8f30-e46c2a93f826", "comment": "Malware payload (Rhadamanthys)", "value": "273ac15d087e2fd827aca62dfdd322f7878cecd2e2363ffcb3ca04048f96b36d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879800, "uuid": "87988fd5-6f62-4186-89e7-fec47eb7f088", "comment": "Malware payload (Rhadamanthys)", "value": "28b314dd4b3c07eff4704f17b0a3b69df9c9f44d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879800, "uuid": "cf72715c-5d27-4d57-ae4f-ca60766083d0", "comment": "Malware payload (Rhadamanthys)", "value": "ac510f77b64337f0e92ba182083f64155742c0e86b808a4b2015755f54f696ca0c1dff4694630c0b78e6cdcde94d4714", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879800, "uuid": "6f4c5606-9ebd-481e-8149-c25247901d4a", "value": "T1D2A30AF5FAC219A308CDBD25BFCDD8AE904441456BC29E07AF1ABB300AC5F5796944CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879800, "uuid": "46f55e00-0946-4dae-bb31-975c40dbb324", "value": "768:GDhd0i7J4sYKgY/CMNfWd1C0JNcjcnrXWYrS4GcFKcLHwwcpcmcNAOcvckcRnY5j:GDB7eKg20Nbr/rS4d4qASYk6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879800, "uuid": "e3498375-034e-4aef-b0e8-3235288016b8", "value": 98130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879800, "uuid": "af52aa4d-5809-4c1a-ba14-b7a4555117e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879800, "uuid": "80d8da2d-fde9-4eec-a57d-d01f05cefda1", "value": "invoice-1637482117.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b0e8d9-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879941, "uuid": "2c934f4b-16c3-4fd6-8e68-9a6c3e46682a", "comment": "Malware payload (Rhadamanthys)", "value": "25f097ba690763b0129cdc41ab7732e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879941, "uuid": "82a98254-42b7-44e3-ad1e-2ebece424588", "comment": "Malware payload (Rhadamanthys)", "value": "27b9473e60f72018134bfdb6d77d7d280b9496766d9801768219b53b55a8588f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879941, "uuid": "6a0f9455-02e8-4a1a-929c-b15aa935f11e", "comment": "Malware payload (Rhadamanthys)", "value": "3dab6ac520ac0597b1fca0fcfe5c711084875e5b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879941, "uuid": "67ce76fc-9e63-40b9-8b0c-ec5edd7ca953", "comment": "Malware payload (Rhadamanthys)", "value": "74ca618aa20ba05fbdf7ccda7fd2f7b9404c33fcecbe25e464b66bb7ab884fac47d6adc6d9c427d7fb4ec0f6a9525065", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879941, "uuid": "1d9a1de3-9ce2-4079-a1c8-7bf69f555013", "value": "T184A32A77ED0BBC8F324FB2E99C4412858309A7544A619BC1436FFAF5A5AAECC3D151C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879941, "uuid": "7237a660-efc4-47e3-981a-833cc4d0ccb5", "value": "768:GDhd0i7J4sYKgY/CMNfWdpiBW8pJvss/2FNrrXk+rP4WObKHjByhoAOixNMinwSP:GDB7eKg20Pjr5rP4p+3AJ5w6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879941, "uuid": "5abafcf8-30a1-4cc8-8530-d0e01a4a2f47", "value": 98706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879941, "uuid": "4d73c173-a38e-491b-a553-7f85a7169367", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879941, "uuid": "ffa9588d-4900-497a-b8c5-fc21019a9e2c", "value": "invoice-1637482117.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f637455b-da4a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765867594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867594, "uuid": "7ad7f77f-5d9f-46a6-86f8-4c6b062493ff", "comment": "Malware payload", "value": "a3e0b6afbf46210ff8e43350989a884a", "object_relation": "md5", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867594, "uuid": "e913d7cc-f6e8-4859-9d63-55e844be190a", "comment": "Malware payload", "value": "28b29498f4612c7dc51cd292c9a837f9f14d90418e4054521b5fdd414d2e365c", "object_relation": "sha256", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867594, "uuid": "5a392f34-0c61-4db0-ba65-2b95aba5809a", "comment": "Malware payload", "value": "0722086e3d6de38e224416ce7901cddc3a65c7d7", "object_relation": "sha1", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867594, "uuid": "9d90f7c5-ac2d-4223-adeb-e0b34a3acf89", "comment": "Malware payload", "value": "c97b4baa02aaa1b33a989b450e799e094d1a487ed5ee4642e3931cdf92b52e7d5cabf26b0e378ce63d8753fcad85137b", "object_relation": "sha3-384", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867594, "uuid": "b6747dc9-6068-4d04-815c-42e72f9d175b", "value": "T123853321DDA6DCB50DE8D629403F1C2C3B640F47886D995E336294CF7F93B82151BABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867594, "uuid": "16fc3ad2-d880-45c6-a99c-eb2c0aaf69ff", "value": "24576:8MkDCMHZ/qGTvThGzY15lz6X05NJ9mCKRgSTyDO41Zz66RXq1Y4O2r49pIgoD27m:8EMHXvj1J9m7TD41UzWrtH7Jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765867594, "uuid": "5e73145d-d17e-4e0f-bcf3-c9a587e22196", "value": 1798634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765867594, "uuid": "3f7bdcae-5f31-443e-93ce-1ab546a36b7f", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867594, "uuid": "62b07caa-a6f3-410e-8a9e-8c53fdcc0f1e", "value": "1PhiiiiiiiiiiDec11_phi.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31f93c0-daaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910914, "uuid": "da556e85-6f6b-47b0-8a02-a5336703db9f", "comment": "Malware payload (Mirai)", "value": "4359e1fca2539a90e076941a6effb8b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910914, "uuid": "0192a036-25bc-4c6f-b027-73a8c1541673", "comment": "Malware payload (Mirai)", "value": "296cfae64c21474b2f54abd6a2b05bab70a0b48eebbfa4e244d2783081c5d238", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910914, "uuid": "a623a7ee-8363-413c-9714-0d54b3c0cf17", "comment": "Malware payload (Mirai)", "value": "0546106791cd6aa24fb794f64e3678e99b55276a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910914, "uuid": "fa351250-7926-4c69-96ab-c4b05b809dc7", "comment": "Malware payload (Mirai)", "value": "4af4332a3fc9c500728bc3f1d91a3c719d31c56e112d31800222621240dd922b6a4f180996abd375aa9865d99e7dfcf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910914, "uuid": "a3ab1df7-5a59-4f20-a889-be10fa2d6aeb", "value": "T177C33A26BCB83F27D0E46CBA51D38626E167571810F8D61DBC720DBCDE3D1602A6B672", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910914, "uuid": "735b195f-2055-49b7-8ac6-8b064388b4fa", "value": "1536:9+HldRS9WfIlzvGJc/1Ze3cVWxcfe7++21BcjvNtS3WtGgasNce0dI3hjb2BP:9+FCPdvptZeT2aWSjfjyBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910914, "uuid": "b7d0292a-e09d-49b1-b5b5-bad415b898ad", "value": 125868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910914, "uuid": "8163a296-2f6e-4479-af24-7860c0443025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910914, "uuid": "2f294bed-6791-421b-88c2-de0fc862126b", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d96ae0-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765895784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895784, "uuid": "d77f6f28-9879-4a08-abe0-749fb5892ad9", "comment": "Malware payload (Formbook)", "value": "975bdaa97578b0abc466b38007a8f2be", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895784, "uuid": "9ce63440-0354-4e9e-8358-99529217c393", "comment": "Malware payload (Formbook)", "value": "2a3c65c21cb1e72566f4f524dce51cb9297aa190b387e184f959bcf6fcaecd17", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895784, "uuid": "2eb01e5c-0d66-47fe-8a7f-53caec5f7987", "comment": "Malware payload (Formbook)", "value": "e8b2a1bdee336e7407ecfa66da70b120da28d05f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895784, "uuid": "25b99652-8765-4d78-8155-90bc037de4d0", "comment": "Malware payload (Formbook)", "value": "917a6615a66fc322c13f7238c1143ae8760e8fd2a97bf9bdb606b71ec5147a2353418802ef423f98c19d5d24348051e9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895784, "uuid": "59f3c798-1893-4422-bf83-7fb9a67a99ef", "value": "T1B2F423D61B0D3C61B60B2285B9D5C27E20D53FC2719B56B237EFCBC257636A2644D902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895784, "uuid": "8dd15c6d-2d63-4e27-a44c-f291aca0c3ab", "value": "12288:w9YjFQ9zt9Fai7vPgvStM9Slt6yFEoBe3prdOGpAmk37G95uQjFSIN:w+uZ8hS696tvFEoSrd3pAmuG95uQjFSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895784, "uuid": "938f00cb-9280-44ad-9d9c-8e6b3f6c72f4", "value": 727251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895784, "uuid": "a372968d-015e-492e-bee9-9bd8a25d52a5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895784, "uuid": "18168f04-2442-45b2-a047-e06388868d7e", "value": "MSC NTN SNR.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6e42be-daa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905566, "uuid": "7768bde0-69ef-4ebd-8868-012f6fd809cd", "comment": "Malware payload (Mirai)", "value": "8cd191a2f22bdfad0693361a1876b90e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905566, "uuid": "aeec2789-5960-4130-8639-26dd4fba1cdc", "comment": "Malware payload (Mirai)", "value": "2a73211e20de193a0b1ba2a31b58ccacde50259739df3b54d29f1dfd63859d65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905566, "uuid": "82f48539-d151-477e-8181-7e97bfd8c972", "comment": "Malware payload (Mirai)", "value": "903f446d113c1962bfa4e404387b42d8ed9c8043", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905566, "uuid": "aa56aedd-d4fb-46b6-b177-c61841017f25", "comment": "Malware payload (Mirai)", "value": "95904009b156c64341606494146bdaa5d758b4390d3e9016a00ab9bdb95542fbe9afb4518b5e0b3be6748712c9e4e80a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905566, "uuid": "c4c1d3ee-a56b-406b-a7fb-1f8f67430d8d", "value": "T12BB33A96DB93D5BAF425013191725732CA38FE3A006FDACBEFA499B1AC10201875D7BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905566, "uuid": "496e5d1f-d205-443b-8f9a-990d0df0b0ff", "value": "3072:PdOU05lLpTWCnSCalCOlJsBMYndtaZZXUeoD6AuUi:P0UqpCkSBlCOlWB/nXyieoGAuUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905566, "uuid": "8a33e226-ce89-43ce-a63f-5b4e648a94fb", "value": 115664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905566, "uuid": "05502102-16c2-41e8-a2a8-2d98a083e12f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905566, "uuid": "c33b4326-eb0a-4074-9e58-6377959fdeff", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc952030-da6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765881724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881724, "uuid": "27ff24f6-d90f-4587-b233-5cd353feb2ac", "comment": "Malware payload", "value": "c17eca0060a35299ba10f48ab4dcfe61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881724, "uuid": "49798f21-2180-4d82-99ae-2b12f59d139b", "comment": "Malware payload", "value": "2a7b6d4238382c015fcb7e292f4f6b9c8569a49a74b793930b83d0b6c4aea279", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881724, "uuid": "21b81352-c714-4621-936e-fa085e9d631b", "comment": "Malware payload", "value": "d1ece8a2f6060314de6f9acc70e8a4fc5f7c0ae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881724, "uuid": "4cd31a4e-736a-4da5-9151-87b0347f4d06", "comment": "Malware payload", "value": "802d513555878060f811520a9c12aa163a580e450ef8fe04e7591b5c99c33d3531c06b45b4ecaf05f813d3a8c567852c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881724, "uuid": "4780fbf7-4a65-4501-9200-426bdf398986", "value": "T140545B1C63CA5A35C3FB9739CAE68404CB74B80B5696E30E358C60946F73361D662F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881724, "uuid": "1bb92243-0d18-4746-bc18-7bf5b074bf27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881724, "uuid": "4c828073-eafb-4637-8d6e-972af829d68f", "value": "3072:QOcYQYjMAGEMBSGjxQOXGB4gnZBnomcLZl1x4oFF8QbJ4N4Ot87oYXiUFOgU+Db+:QOmYmMGSOXc4g7omcvPF8Eg02gQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881724, "uuid": "a6e4e335-7800-4f7e-ace3-e6d04d41bd59", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881724, "uuid": "f8b3660b-e1c5-459f-b75d-3ac14f9efd58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881724, "uuid": "1ec7a30b-12ba-47dc-8b74-f12665c94d0a", "value": "cdn-10049480.file.myqcloud.com_2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dae718-da63-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765878042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878042, "uuid": "c31e8ed3-372d-4fa9-b439-699653df527d", "comment": "Malware payload (AsyncRAT)", "value": "4471785758d3b0e49d85ea08e935055d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878042, "uuid": "c1938c47-3b38-4151-bd09-4d2e7eef2224", "comment": "Malware payload (AsyncRAT)", "value": "2a92270b6371ef333ed36d07fe6d4cb6c83f4fb504956e8c26964f68be44ca60", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878042, "uuid": "dacf4415-b9c0-4a78-993d-857264aa44c5", "comment": "Malware payload (AsyncRAT)", "value": "de33424dff37030367ea8e9b7b8d280debe73724", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878042, "uuid": "222b17be-f75e-4d8f-af0b-37a1957886dd", "comment": "Malware payload (AsyncRAT)", "value": "ca8d33943165624f9053e535b60a4664463d307ef638f95df0c229627589b58a8d32824b8e44cee56f70e6d58f891f07", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878042, "uuid": "bda6b4e3-88c4-4a11-b6d7-53239a43b5a6", "value": "T1D54633B5C88733EACD54F71EA2B63D45FAB0F63E113921781B1F3D452844A598C68A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878042, "uuid": "a9e1b0a5-e070-4547-895b-bf91ae54d872", "value": "98304:NoWZbY8J+dYmB34ffM8bsUwjUqSVIZcvuXuHP7sNeM2VWiUJLiLZVR:NNxcdRP1S6S1QwM2VHMgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765878042, "uuid": "9e2e3d61-11f4-4d8d-a2a7-dc8f49c88dff", "value": 5783601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765878042, "uuid": "a3abb2bf-1257-473a-aeda-910ac7134931", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878042, "uuid": "4814fe2e-6a3b-4181-904d-4bc404518ff2", "value": "Transaction._History.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6981a12-da5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765874815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874815, "uuid": "5d5c2a85-8f70-4e84-8a0e-605cdd9b238c", "comment": "Malware payload", "value": "5dd2cc5b4d439849982c7135da50cd35", "object_relation": "md5", "Tag": [ { "name": "38-55-205-7", "colour": "#9A8F12", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874815, "uuid": "705a3848-ce3f-4767-b1da-7cf3d4cc07df", "comment": "Malware payload", "value": "2ae821deda2e7358bbf62649d51ac607480765f99940cd09aa3af8aa81853509", "object_relation": "sha256", "Tag": [ { "name": "38-55-205-7", "colour": "#9A8F12", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874815, "uuid": "ccaa6736-cec8-4db7-ad72-cde0570319a2", "comment": "Malware payload", "value": "940938aa1a16c3b0dcbe855dccd4066417b23916", "object_relation": "sha1", "Tag": [ { "name": "38-55-205-7", "colour": "#9A8F12", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765874815, "uuid": "85a430c2-a53a-4f99-a861-728b7621d606", "comment": "Malware payload", "value": "8bfdb8d23c7125b716288b454db5684f7d1c6dfc17bca26f7aabf39630eb7c2ce1722f99c4e0a5005545ff7dd464a753", "object_relation": "sha3-384", "Tag": [ { "name": "38-55-205-7", "colour": "#9A8F12", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874815, "uuid": "8fd4f230-13a6-422c-9043-58cfcfd6d4f6", "value": "T15E124047A2D0CE3FC8D953384467122472B794BEDF629713064915B63F423E81E2EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874815, "uuid": "80c0a370-b16e-4dae-b0bc-3f717b8724a3", "value": "96:GqTVJWWGXzS6WH5ML09V1J9G8Ymc+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHJZMWT1Ym9hrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765874815, "uuid": "7174cd02-47fa-4168-a895-e01d5d834e6f", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765874815, "uuid": "be232f80-0794-439e-a6cc-e39e705b3f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765874815, "uuid": "a332731a-650f-4a65-aae4-0a8291de4af2", "value": "2ae821deda2e7358bbf62649d51ac607480765f99940cd09aa3af8aa81853509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403ac5e6-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879744, "uuid": "32499ecd-34a8-4819-bd18-dbc16e34ea8e", "comment": "Malware payload (Rhadamanthys)", "value": "1a539073aaab7b33e994bee6e1a9024f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879744, "uuid": "703d4ddc-6dd0-4e12-93eb-19a214086528", "comment": "Malware payload (Rhadamanthys)", "value": "2bebe929089a2ad31f0eac97e8018b9647ea7ebdb1735eead1f0afd58e45a1f6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879744, "uuid": "ca85c341-815a-400c-a161-4475409090ba", "comment": "Malware payload (Rhadamanthys)", "value": "8841a26dbc504ef4a39ba9394646fb3456caab61", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879744, "uuid": "07ae8592-c985-462a-8174-cdc26c803e57", "comment": "Malware payload (Rhadamanthys)", "value": "faf91077cbd89b2695d6ccc8275454a61ec31418533afe7e3ab06cdc64a53c6751b9963f1ed31bba72eb640ffaa1f06e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879744, "uuid": "42b364a9-e71b-42b8-878d-1726d915a5d4", "value": "T124A3F87C9C81F633041869FE3E0610F2822F61B55C519285ED8ABD12B88E77F6D45AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879744, "uuid": "1c292faa-8611-46a2-abe9-e22c6d26c237", "value": "3072:GDB7b0OdNf1CgP0qevaadHo4YUtpQ+wCrxrS4Hf23mp0JpF+J6Xkk3jHuNcO7igG:0eJERJMNfbqrb+dcWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879744, "uuid": "c60db8ad-1fb9-480f-9f9a-66b29c4ee245", "value": 100584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879744, "uuid": "baf16668-3aa7-4e68-a516-2f26807b9671", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879744, "uuid": "297495ca-009b-4931-bbcd-227daffebeb1", "value": "invoice-1637482117.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88f86ef-da47-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765866175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866175, "uuid": "87d8be3b-80ff-436f-ac3b-20022584e883", "comment": "Malware payload (Mirai)", "value": "781c3c9c3fc523a3e2ecab1481cdc6f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866175, "uuid": "b8bd97a8-45d6-4375-9504-884c04b899d4", "comment": "Malware payload (Mirai)", "value": "2ce31eff214048cbf48fbeee361f84865411227107c825c07b9efc30c8a17eed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866175, "uuid": "d90f00dc-b208-4264-bc35-dcf498a4100a", "comment": "Malware payload (Mirai)", "value": "6e0f781f86b051f37b35f690c37c73963d9a374f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866175, "uuid": "99484a23-675e-43b0-819e-3d976018cbaa", "comment": "Malware payload (Mirai)", "value": "f25855b8a66358f44ace679849956e621b50c2f76dde4de0a9959493156bbffc42e97b505f30bd88040c4b02dc213290", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866175, "uuid": "dad58939-b39b-460d-a459-07d30b215a94", "value": "T157934913BAC498FED499C1700B7F603AC461F56E2135B1AB3BD0FF226A9CE212E1D655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866175, "uuid": "1434499d-8995-47ab-8b07-fda80668f860", "value": "1536:DlobY+M5PO6oeTBxLEKoze0Fq9WnclKRxTD1LjeWw3fn1ATfor6WWEgL:C0+M5PdVke0FPOIxTD9eWw/1ATi6KgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765866175, "uuid": "c8f33c31-6688-4579-adfd-88bd48f8e262", "value": 95152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765866175, "uuid": "8fab9930-be3a-4efa-8c63-bdfdf9a6c1c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866175, "uuid": "040079f3-9e47-4b85-a96b-6f087adc5c72", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de527c66-da1e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765848656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848656, "uuid": "2d42cada-e069-4884-889e-49070d61c4eb", "comment": "Malware payload (Mirai)", "value": "066be513f7e5cb0d984f07b4d3ab2c66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848656, "uuid": "302a8fd2-ae81-41eb-a4c8-58a653bc9344", "comment": "Malware payload (Mirai)", "value": "2d04cc7e37160edd396e132bd1a5eb3372fbb79a51cc0e1627a2396d74beb7cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848656, "uuid": "9bd34d21-9637-4bc7-b886-49482cd05640", "comment": "Malware payload (Mirai)", "value": "7e5c96251e703b9153deabd0f2e15c8f27f53dd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848656, "uuid": "f90110d4-5c1e-448f-bd68-a892bf2d22ab", "comment": "Malware payload (Mirai)", "value": "3d654a3a21384395e3f9e71021edc6d24a2dc826b5e29a2643585f501dbb6457aea134cd8ffa89313b1423ca4d69d635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848656, "uuid": "c0d9d5f7-c7db-4477-8a38-aab303cfeacb", "value": "T184932A63CC656EA8D628D5B4B0B08F792B639510814B1FBE5667C3758443DCDFA0A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848656, "uuid": "11a91653-082a-430e-bf1a-e7e4b5a7c5af", "value": "1536:Bq3+zxHzb2kcCLyipbO7WDM1oaK4vrfy26vy/s:BpVHzb3ctiJO7WA1o94+y/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765848656, "uuid": "399adac2-6b7a-42a9-a891-a71d377d97e2", "value": 96688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765848656, "uuid": "bdb67c34-040e-43a3-a369-f19b759c9d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848656, "uuid": "74475ece-2ac9-4203-be42-79be4f40da0c", "value": "nuklear.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b91e1f-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879728, "uuid": "5c86ba24-1bae-49a1-9940-9491f56d14d0", "comment": "Malware payload (Rhadamanthys)", "value": "ca25115c7d5756d100a65b9635f2f653", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879728, "uuid": "ea9d103c-3874-4e3d-a09d-f87c5aaf232d", "comment": "Malware payload (Rhadamanthys)", "value": "2d1ecf040dc9980febaaf90707a3adff656136b06cc8b25984e5ed35e59b914b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879728, "uuid": "6c26b152-a35a-49f6-a1c8-f3f45aade305", "comment": "Malware payload (Rhadamanthys)", "value": "8a5b919a8bc6f294325b8ccfe8aff639c342a71e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879728, "uuid": "4b1cbc52-b80c-49b2-9c7e-8b3fababf61e", "comment": "Malware payload (Rhadamanthys)", "value": "2b91e110f929e01d6d3539103986994bc669bb2283f084eeac7c301d815f8f0304fa7e7e800cd02bf35b63fc36be3a7e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879728, "uuid": "39d765cb-4780-4db1-9814-28997ded4274", "value": "T192A33A86BD6685F33CB0B8168DAC39EE68CBD9140F85D494C01D73B3ACD86DE19864DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879728, "uuid": "91fde5bd-be89-48b5-9134-e2b6981f5218", "value": "3072:GDB7b00J/QX/0zT6hdVe6lUGg3LHEFz5Vmj4YWEeEy7uCQLEQkUfxoqXW6Vq7NlE:0fJ/QX/0zT6hdVe6lUGg3LHEFz5Vmj40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879728, "uuid": "f816e0f4-0c27-4f3f-8958-8a09d90e3013", "value": 98803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879728, "uuid": "9327c1d9-4087-414e-8b9b-52728205f808", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879728, "uuid": "d4c11bb1-a5a0-4b3b-9c25-0459cbda0234", "value": "invoice-1637482117.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8eeadd-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926927, "uuid": "aa07ae0f-99d1-44db-b45a-43c3a06d9166", "comment": "Malware payload (Mirai)", "value": "c856d83b14273f48a53e2d9d0bdb3391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926927, "uuid": "b0ade771-9b2c-4a15-8413-f0f6100ac18a", "comment": "Malware payload (Mirai)", "value": "2e027f0f14977c903c68335aa8f25e3a6ff8f9163f8947c07749bef3819653be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926927, "uuid": "f56b87fa-a429-49f6-859b-fbaf771e2195", "comment": "Malware payload (Mirai)", "value": "21652898b64e58d7ff62a0c9c7977c90057b92c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926927, "uuid": "2037c24b-73d7-4660-84e3-fd72ddf04c09", "comment": "Malware payload (Mirai)", "value": "4c0ed5b073700fa9f758bfe0cb1e9e50caf2e746606c6d58f063389068e0b9a1af5a7f2b2442595f00c2089e6e82a10b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926927, "uuid": "1606aa63-c4c9-44f2-a7e1-c25db5f25202", "value": "T13EC34CCAB318C343E1636AF56D3E27F49F9CA9A151B8BB49355B660F1572C324009ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926927, "uuid": "7ce49e00-cf3d-4b80-8f91-983d585bda8c", "value": "1536:P6WGiJ8vpdh8sJaUtSTLPinO8H1qvL90GuSyjd0zT8nXYVR15dIFv:1SnsTLp889DuTM8nX25dIFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926927, "uuid": "f6061089-b301-4fea-bd58-eb2574bee3ee", "value": 121580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926927, "uuid": "df3c990b-2bed-43c6-a700-067edbfd8679", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926927, "uuid": "b2c9ddfb-ccfb-4a93-b892-1190277b81d1", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886450ca-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879865, "uuid": "b71528ee-7297-4073-bb74-63c4a64c062c", "comment": "Malware payload (Rhadamanthys)", "value": "56a8c53a12b9276ca5c3d2ec548326da", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879865, "uuid": "2d38d3dd-ceab-4063-8795-6ae372504966", "comment": "Malware payload (Rhadamanthys)", "value": "2e0861e120c7e4a8416ae799e3255df7362f8b62e710882c307c0048aa5ce208", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879865, "uuid": "a14bd9b2-1ea4-4c79-90fc-adff9160325b", "comment": "Malware payload (Rhadamanthys)", "value": "fa75b84ba0bafa9be5e9fd9f21daf8b055448741", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879865, "uuid": "90d40a9a-30b5-472d-b919-65937f6374ae", "comment": "Malware payload (Rhadamanthys)", "value": "d57502b6a2be34244e51b3ba91c87def77105aa7ae94c7040689522b2fd9f696f39019aca7340bd34f323466465519fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879865, "uuid": "933b6782-785c-45c1-b73e-bde6ad90cf5a", "value": "T1EAA3FAB41DA9CCD53554E0354FA5E8E3604ED8E21B5895EA8B1BF71208FEB11ECD38E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879865, "uuid": "54be471d-03f5-4506-ba66-fed7be9884f2", "value": "1536:GDB7eKg20r2ZrarE4x8a5ZOvPAJ0ZFpq6BkQWJ+aY:GDB7b0oYJD6pq6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879865, "uuid": "c50426ca-f720-4f2f-b802-2d4be4153584", "value": 103974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879865, "uuid": "86e6d9c2-850f-45b5-a365-777d566af15e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879865, "uuid": "be085d9d-2d87-4e9c-a99c-aaf1b41ed690", "value": "invoice-1637482117.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26aad5e7-da43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765864239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765864239, "uuid": "c5730bf5-a10f-45da-8d8b-67b02bc354b5", "comment": "Malware payload (Mirai)", "value": "20b85db08c5048b7291ceeb12c6537da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765864239, "uuid": "9db0fa3e-dfaf-464b-99c5-5f80b435153a", "comment": "Malware payload (Mirai)", "value": "2e7c37769624e6dfef412f4c0db57fc2c206c7833efee583a51f41d9057e262d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765864239, "uuid": "f3f3c0af-da0f-4542-a256-e3042f808220", "comment": "Malware payload (Mirai)", "value": "e8187fe866daa9425ca52ba13d6c0d7d3ab337a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765864239, "uuid": "6f62dfd1-887f-49fd-b355-4d32b9cc2d82", "comment": "Malware payload (Mirai)", "value": "bf20bd083a6a2bc41e9fe9c6b0f72cfbc93ef84f75756e8f089458894e87886f75caba3391b22c1a657d76d08cf59459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765864239, "uuid": "1d935bd6-6c18-435a-ab8b-d691c029faf6", "value": "T1C6E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765864239, "uuid": "71b536bf-abfc-4589-af21-180e3d1c6181", "value": "3072:5U0snZ0UxtAtDX5EgzgmaTmXeU/bXYCm3U6WRpL:5U10ekDXegzbaKON/3U6WRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765864239, "uuid": "4d928579-1345-4597-aa79-e842e163754f", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765864239, "uuid": "18f6ed31-a273-4bbc-b457-983fdb8b8d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765864239, "uuid": "57f0257c-b600-4af1-86eb-ca86bdcc28d5", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2960da21-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879705, "uuid": "4ae1e7ad-193f-4037-a20f-5b9e08f4317c", "comment": "Malware payload (Rhadamanthys)", "value": "b837b708e45457ccccdc8dac67a74a83", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879705, "uuid": "ca089af0-03f0-444f-a8df-eb84e10e1af6", "comment": "Malware payload (Rhadamanthys)", "value": "2e9f473063963f1b1cb750e626f4a8d02804e2b9186b36ab0dc82e2372397fd0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879705, "uuid": "5ff34a6e-5fa8-4ef4-b517-2d95e7511fbb", "comment": "Malware payload (Rhadamanthys)", "value": "c2516a4a6a800f0e46995d549ca2adcb3632b586", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879705, "uuid": "48f86573-0502-4e8b-a434-6cb01360578e", "comment": "Malware payload (Rhadamanthys)", "value": "3b4954bacbd1d83df20f1835baa3d6bd0aaef01c42d1329f46830f7023f7bf18456d1c26dd99b8fe4fd9a5b96d9eaf9d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879705, "uuid": "2411d8a5-8887-4b2c-bd77-bb204c19056f", "value": "T133A32B333C57DD71180EA7514FA21BBD0C7BD51190061A99BB8AB676E0EDF98B4388CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879705, "uuid": "ee73d953-bf10-42fd-9cdb-a65c388ffb7a", "value": "768:GDhd0i7J4sYKgY/CMNfWdBMJsGpuR4O515lc5zpZRyWNSNgSGe67titZ4jvbdhw5:GDB7eKg20G/r3r+OfszAosp6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879705, "uuid": "d0d7c159-4ffa-46dc-9633-99d4e69182e8", "value": 100094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879705, "uuid": "2ab9e384-b636-4155-9aa6-1ce2778978bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879705, "uuid": "fc3bc09c-7135-4db6-884b-f039b1492983", "value": "invoice-1637482117.pdf (54).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9fae9b-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879578, "uuid": "6b34aa2b-aa5a-48c0-bf3c-c1017cc10b09", "comment": "Malware payload (Rhadamanthys)", "value": "4a87731b7089885ccf0f148abc573379", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879578, "uuid": "20f41548-3380-457c-b8c1-d76b18112b04", "comment": "Malware payload (Rhadamanthys)", "value": "2ea17f3187893ac1979945d607316811b49f3a1166970f2ed8f80b5b76dda4fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879578, "uuid": "f1e3c0dc-9c71-494d-951c-299387938e48", "comment": "Malware payload (Rhadamanthys)", "value": "7729c7ba1a0a1060f194bffb74d74e84d1164df7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879578, "uuid": "2c5a2403-f2ca-4a6c-b10d-4505d129b834", "comment": "Malware payload (Rhadamanthys)", "value": "290b44c83f6967729d27932c6a5bfc16d6717718b7129c0f2d735339cd38e9f5edd704a947ae0d249cf8bf4eec71bb55", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879578, "uuid": "eba4b713-0101-4d2b-b3d0-77b32228ee5e", "value": "T192A3FA810C77B4F024627DE226BC18B6278690554875983B434BFB67706FA6E0EC6FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879578, "uuid": "2106fd6c-ffb5-4e88-b817-a1595dd5ed76", "value": "1536:GDB7eKg205/ahF2SfKPeMHRPIJNN9c0FgZFhsND7wBwHFOBBGqB9cT6jyyDPr/jM:GDB7b0iITTeEwI6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879578, "uuid": "7bef738f-3472-4fe0-bb51-028eab5303c6", "value": 102054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879578, "uuid": "c5201364-6b06-429c-9c4a-a85f5c6d55e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879578, "uuid": "b15f1060-4bc3-4a17-8fff-cc88d9087b6b", "value": "invoice-1637482117.pdf (75).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cee8501-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879738, "uuid": "a8436422-e5ca-4ab2-bd0c-f1b9a5af526f", "comment": "Malware payload (Rhadamanthys)", "value": "e4b65c70b8c1a0e87a199b3b77649971", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879738, "uuid": "1a64d6dd-e8f5-46db-882a-6854e1adfba1", "comment": "Malware payload (Rhadamanthys)", "value": "2f1a7dadd6c7693afd3958f2775026943ab71c8acd90afe0134e815382b99168", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879738, "uuid": "736c05b9-d4cd-4f37-9a0f-fe55632f376b", "comment": "Malware payload (Rhadamanthys)", "value": "3d7627351590a34414b041194d64de6dd1de8df1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879738, "uuid": "2c2a4026-2b06-47a9-9b29-e02aa4ece963", "comment": "Malware payload (Rhadamanthys)", "value": "87c02b22fc7a1c9373d53d620c3a754440b046bd62451a39c9dadfe9ba268db8339387986ceebe97ececfe725385fbdd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879738, "uuid": "15b5d534-1308-43a6-8271-2df65e6ff4e6", "value": "T138A32B21DB23DDD73040BC5A3D615928A1494AED8CC122E8FCAD77E7935C38799B89CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879738, "uuid": "cb612b04-ca37-40b8-9f84-fe2919173f9c", "value": "3072:GDB7b0mkD55HAnkjnEqa5QIdZ6n8AlGIWN4wlMtjwWf+Ib4IUSGaO4ng8TCfGuU+:0JF7v9Wkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879738, "uuid": "d24b9335-3d68-43dd-8c33-581edcbd3493", "value": 99390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879738, "uuid": "e99fd3f0-128a-42f5-a585-f9eeda9cb37d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879738, "uuid": "23385124-9abf-44be-aa47-f6300b5f6459", "value": "invoice-1637482117.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2357e53d-da77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886567, "uuid": "6e1b818a-f828-4ff4-82bc-31b68a227332", "comment": "Malware payload (Mirai)", "value": "cf2b6a9ecb9e0770e4d2f73df0ce39ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886567, "uuid": "df01588c-4afb-443b-9915-9eff209b3a0d", "comment": "Malware payload (Mirai)", "value": "2f38d141aca6e08b12ea06eba8ecc62be0e0b52e9c025aa60258a28dbf322cc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886567, "uuid": "81da3005-bf3d-4a28-88ec-2f801043893c", "comment": "Malware payload (Mirai)", "value": "3d636e4b2940013e8206f55b305d2056f4e2225b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886567, "uuid": "dc2913e3-0377-43d9-b36c-210ee74c3b27", "comment": "Malware payload (Mirai)", "value": "04efb1391d6002e526685a26a37afca12e6d1b355a34778627f66856dce4cf474e5a14b8dded9cd33e51fdc2eac8491a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886567, "uuid": "6d66e8ef-93b4-4f8d-a434-6f44bab58477", "value": "T17FD3F649AC408F11D9E323BAFE5F118C335693A8E3EEB117DD141B55B7CA02B0E7A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886567, "uuid": "2de55224-2d60-4800-9183-d8cd6a8f00a1", "value": "3072:Ex/nA8krFbGpPo5q2nuwehotD7AUWjf24YvpVnp5w:Ex/xkrFKhodnRehotD7JWjfVYRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886567, "uuid": "59f079b3-eb2e-4201-acf3-ac9336987b38", "value": 135860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886567, "uuid": "8749fb31-b68c-4a8e-a296-64ffc0ea0192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886567, "uuid": "e2196955-bb5e-45c0-85bd-b561e30a017d", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b8874d-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926919, "uuid": "f5e040cb-002c-4c3b-97a6-3aa6ec9b1f8a", "comment": "Malware payload (Mirai)", "value": "b8eaf5e9cd7a24d8cdff6f84cb345067", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926919, "uuid": "bafe6ce7-8b61-431f-aeda-79a5253e325f", "comment": "Malware payload (Mirai)", "value": "2f689300e4514b2c06ba6ee1a35cb1b4cec681f37b720338851003fc1e361496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926919, "uuid": "f31eb284-cd7d-4eec-a0dd-1cfc6af11b02", "comment": "Malware payload (Mirai)", "value": "fb0ce97606012229ff407142eba8e3dc844765c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926919, "uuid": "1939cc25-c5aa-46f4-a74e-11340d4f0c34", "comment": "Malware payload (Mirai)", "value": "003328fe5de8681dabd0316bb00b7087f985a3a3a3c97721ca7a2a2aba30932fbb84d7f96044985c936be60c2b7c85f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926919, "uuid": "9289be67-594c-4498-b097-6e0478b8f684", "value": "T1B9B37E22814FCEA4E1B86975E0B0B53C87229D0266572DFF5BB984E04087DFAF58F365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926919, "uuid": "5843e614-72c1-40a0-af9e-72b9ab4fd39f", "value": "1536:37SJED+p96Im4G6r2InmS0thW0ykRMU58mSCEJzQ0CgYVRBV:3VDMr46r2ImS0th6w58mS59/CgWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926919, "uuid": "410b0cf2-8790-4061-8e0f-17b0b8cce9e9", "value": 108792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926919, "uuid": "b6f6ef99-cfd3-46a2-ae02-c218c5f457c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926919, "uuid": "79c9d4f4-f791-4616-b340-f7089901a3e8", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf24afe-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879980, "uuid": "872a8a0d-57cf-4006-9863-500839aa615a", "comment": "Malware payload (Rhadamanthys)", "value": "9cb67595c18071c24bfc253bd1771e2c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879980, "uuid": "d1198716-7d98-4395-96d9-10994a1dbe80", "comment": "Malware payload (Rhadamanthys)", "value": "2fbc92ea0b64aae6e6b94a6e73ed037f7d877337280a633143f53582f3c53b1f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879980, "uuid": "9e78d98e-dd19-47c6-8caa-d52210b3e067", "comment": "Malware payload (Rhadamanthys)", "value": "b9891d37d63b15205d5a65ebfca82d5c7e6c6868", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879980, "uuid": "8df298f2-8c74-40a3-bbc4-2fc0a5704aaf", "comment": "Malware payload (Rhadamanthys)", "value": "a3107e879171983f2813b68c76b4b47c0387cd2986e63c2ce1a8be35cf962964cca8b75b3b5b8c8e045adc874d4f2c80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879980, "uuid": "5e8f7255-07af-4935-9ccd-7cea53a60be7", "value": "T11FA32A881FB11F2A3561EB1C365880A85EDED6164C4649798D2FEEC0A26DE0DCF257CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879980, "uuid": "b1b4c0da-8d98-4bb7-a5d0-c65fd79a3881", "value": "768:GDhd0i7J4sYKgY/CMNfWdNcrX6+rW4WIHuzuqtArRW9SLAuAAroQW+FF+Ec+0FO1:GDB7eKg20arbrW4WvHArM96BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879980, "uuid": "41d456c4-deab-409a-8cb7-c64b91e8336c", "value": 102700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879980, "uuid": "bc433caf-d835-4c30-879e-6c9dbf8bc97a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879980, "uuid": "6cc53370-aba4-4e27-8908-3d1c4e9bff36", "value": "invoice-1637482117.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f19fd4-da6c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765882198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882198, "uuid": "0ad08640-4495-41c9-8215-a44b03dfcd38", "comment": "Malware payload", "value": "400dc0e35d232744a31adbf6f75e3182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882198, "uuid": "2e963fdb-d86c-4d6c-aa49-89884ee01f78", "comment": "Malware payload", "value": "30222fa4feaffc3708c73018ddb7aed0c5c5b3b5c8ec4ccb5463045ea9ff8d99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882198, "uuid": "7056f498-395d-4ee2-81c5-abbe129e8ba6", "comment": "Malware payload", "value": "c51c80116cf90f7079589c971db83da46ecd2e7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882198, "uuid": "8168ad36-7b54-422d-a083-257a5dd40b01", "comment": "Malware payload", "value": "13206f0a09341ed80ef27fa2a3c82bedb26dd6288b5ee6e271848029f56696f8982deee5b96a6c65b750383e070aa5eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882198, "uuid": "59480a4a-8075-4d3b-b087-e6af4866555e", "value": "T1876523D600901AA39115283BA46A7FF13F212D6B2B3238582D97EEC7CFB90E54D597DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882198, "uuid": "35338da9-c915-4f9f-b98d-42ee1d9d0c62", "value": "24576:nAHgTVEYTG8g9dnGU3XNqW+E8C73G+xY3/My4c763Gheij87uptkuLpIXEfsxG:n2E5g9hbXUjHQ3G33Uy4+zj87rcpIXEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765882198, "uuid": "573a1ead-b02d-41bf-8e01-b8836afc0d0b", "value": 1425368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765882198, "uuid": "f230fbf7-3692-43ab-8774-50fcd74e3aa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882198, "uuid": "3151cd43-0f6a-482d-a032-c085f3c6396b", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0710359-da81-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765891206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891206, "uuid": "f7c85b7c-7e31-478f-9817-5502fe8a6dd6", "comment": "Malware payload", "value": "ff2eee9f2e2df2f50e8e1551f38b1c89", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891206, "uuid": "d5cbc7be-5690-4094-9927-05332d9289a1", "comment": "Malware payload", "value": "308bbd87cbe2d4f10a09c7e677cf4ffb45f4fd07eb533c8da3544d1ad1082067", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891206, "uuid": "323fbc21-3667-4560-a092-a1744d5afed0", "comment": "Malware payload", "value": "04a2755aae0180a563c85dd5684c444d7070d084", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891206, "uuid": "79eb4f9b-a601-4bc8-95b0-1ea78818c359", "comment": "Malware payload", "value": "3f973acc07f099519b709ede3c7bf140a2f7e53f56030c1147780c0241b2179eb3d1f93b5bd4b942135705f785c6e500", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891206, "uuid": "e92b9cef-3985-41da-a088-e9c0fb641afa", "value": "T126D3BE19DA5EB011FC3ED1A445A9EC1CDB1F411F3992858974BCBAE8BF20768045C9BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891206, "uuid": "1643feca-6ade-426e-ba8e-413c3cc11205", "value": "3072:Q5aUi+m1Gie+T5WKJxMuGyaafG1h6bFpTt6Vrp4+vAc:Q4H6Vrp4+vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891206, "uuid": "9d6d5673-a61a-4ff3-8012-6696bde43bc0", "value": 137545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891206, "uuid": "24cf8da3-c965-4798-8c5c-f9ab0d73706f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891206, "uuid": "9c23ed91-3cf8-4877-ab5c-3d16eef533ae", "value": "308bbd87cbe2d4f10a09c7e677cf4ffb45f4fd07eb533c8da3544d1ad1082067.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2a21f2-da7e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765889563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889563, "uuid": "59ba0644-a90f-4203-b805-61d6fed6bcf1", "comment": "Malware payload", "value": "5f8edba82b9e6ed036326189ba20a40c", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889563, "uuid": "65ced7f4-9992-4eb3-ac1c-eb2684b8abc1", "comment": "Malware payload", "value": "30ba7bb0f75c2bd893e0ffcd25913fe59517fbf297254d3442849513257264b5", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889563, "uuid": "39658582-6524-4b10-9f0c-cca89f0d9945", "comment": "Malware payload", "value": "f5afb6f82f3c8fa3656f7364b54635f289ecdf63", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889563, "uuid": "23cb5836-4a67-40e9-bfe7-4dfc8e93840f", "comment": "Malware payload", "value": "fa0b270e9f65f7bc6615b62c12df6dcce7b3f3cfa38a363a4ae4f4f431c6365a32a1e25d9edce01b34ca30d11b3f8ea9", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889563, "uuid": "4b54f1be-c4f8-4660-ac4f-97ea629c1363", "value": "T1A0E5331027A518CFE45B58E90D17AEF79CE4C8C157450C58DAB9FADB8E29B3BBC0D260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889563, "uuid": "d442d159-0601-4b0e-a271-54e9cf082376", "value": "49152:eefx04rs3g9C3wW1hUjiWXrCDopGsy6ZQY0TSKyXSUfZpun0ZRjjSnXgoPm4UxFi:Tfi8sl3wW1aWW70opvyZpThcun0ZygqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889563, "uuid": "75750d41-4448-417c-b8ca-60b959d6ff74", "value": 3054796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889563, "uuid": "917d0771-8972-4cd0-9bfa-6d7e56f02ed8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889563, "uuid": "b949263f-c7e7-4ab1-9d6f-e8e4464c351d", "value": "30ba7bb0f75c2bd893e0ffcd25913fe59517fbf297254d3442849513257264b5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435e89b5-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879749, "uuid": "e192bd89-2142-46ab-a95c-3dd4fa459f00", "comment": "Malware payload (Rhadamanthys)", "value": "ad0c589b2c8bd739ae5f74f8d4ab76f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879749, "uuid": "2de8caf5-1ffa-4cbd-9bcf-04ee6064cb9c", "comment": "Malware payload (Rhadamanthys)", "value": "30feede5a67e70ebb9436b912cdb3815d3a1507c4b9868baa52c26c221207f03", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879749, "uuid": "764b5a2c-8841-4819-9d3a-7c4c560088a9", "comment": "Malware payload (Rhadamanthys)", "value": "7f28426d4a3970e92e7b99cec17684ec04251b64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879749, "uuid": "ce6e0aed-9a2d-41c2-ba73-fe1d1496ef30", "comment": "Malware payload (Rhadamanthys)", "value": "3c3aca1c6c48d35555fd4d9e1430bdb86ba508e191eeb737a3c4d91cd4941683c898d87268c437aaf9e39156f0ee05d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879749, "uuid": "bdd50654-0f37-481d-9255-7f6a57af8a61", "value": "T115A3D999EF23AC6D2006BD9F6A5D68B0DE1FAE481C0F440ABD013774969DA3C4B58DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879749, "uuid": "720a1aa7-4d30-4de3-8163-baaf892164f2", "value": "768:GDhd0i7J4sYKgY/CMNfWdZnwbzQljpfF4JMSUDIj2QADJCAuDZep41a2L2lLH2m4:GDB7eKg20mrKrLvpCCA5JNk6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879749, "uuid": "1b0add11-37f9-467d-acb3-a60818f9ef0a", "value": 102021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879749, "uuid": "4417a0cc-562b-43b0-a359-5a08b6ac57db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879749, "uuid": "f29f5b26-5eb5-4b7b-885f-7d3baa8be943", "value": "invoice-1637482117.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540a5662-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879777, "uuid": "cafaccff-166d-4c99-8fee-6d880cd06dc3", "comment": "Malware payload (Rhadamanthys)", "value": "b4b62260c7303fe126c45fdf4c550bfc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879777, "uuid": "dbad3da7-639c-4d67-b2e6-43f1955229e9", "comment": "Malware payload (Rhadamanthys)", "value": "315233fff9dcfd61f5a776080b24400d02ffcef0d4217e865f46e489c3d17fd5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879777, "uuid": "8169e21f-efe6-4781-b5dc-6ca1fb73ceb7", "comment": "Malware payload (Rhadamanthys)", "value": "6f26749d94919ff42cfdfd82c7f8d37b6f3284ad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879777, "uuid": "1a521de0-4e22-408a-99eb-a5f09d10cd20", "comment": "Malware payload (Rhadamanthys)", "value": "0c5696067a6852b0dd7a4f59a1f08c96f0ef0f9b5cd99c777409f6ab42e887b6c2ff1205d19082afae0a847aa5d2f4c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879777, "uuid": "09b9f99c-b805-4248-8a38-daee9b4ff07b", "value": "T12AA329828D3798F016B116E90DA937E3DC9DD72F7848AC719E4BFA1574A9EA0040D2CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879777, "uuid": "7e5afbf7-d706-4934-9bee-87e93abdc1ff", "value": "1536:GDB7eKg201D2dr/rs4HfPSNSfFAvc5xWI6BkQWJ+aY:GDB7b01D2lTRHXSNSfKc5xWI6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879777, "uuid": "e4af9078-0af5-4940-aeab-4a4ac5aa4018", "value": 98137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879777, "uuid": "5c62aa45-3d82-42b0-b09a-40ea761d8e90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879777, "uuid": "c840a59f-e59a-46b8-bf56-8c32a70afcd3", "value": "invoice-1637482117.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87590f9e-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879434, "uuid": "d40c6ff9-d52a-42c1-965f-431184e1204b", "comment": "Malware payload (Rhadamanthys)", "value": "cdd25c452f12f8e455ae94a22c76d411", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879434, "uuid": "bc2fc4df-98db-46d0-bae0-c600c5b8f102", "comment": "Malware payload (Rhadamanthys)", "value": "3252072e89a885e5f129043a7566b505e3af39e7f93c6f856c6b0e56d45f4788", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879434, "uuid": "2c34ebbe-f7e9-4432-9b38-d6776e9497b0", "comment": "Malware payload (Rhadamanthys)", "value": "6f989c59750e7114f0cba8eff1b23b3131867082", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879434, "uuid": "23732fce-58b9-4494-8120-4d43b78d502c", "comment": "Malware payload (Rhadamanthys)", "value": "e72caaf96fd5d247c43a91f48ee62b62dea9bb32a2b62c767400c0f54d3cbcb28b22b764f7c852727a7264a71146f23e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879434, "uuid": "3946e6a4-9851-494b-8b25-0262a6d10d14", "value": "T121A3E96D8215DCCC341559902F8222E7E629E985DC205FC40B6A3FF8796868FDB707EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879434, "uuid": "e7d10637-30a7-4678-9d32-41f7abbb5921", "value": "1536:GDB7eKg20ojTX1aWfzs/TS9vbbUC/eMSVLS2oPcYNw6Mvohhw5rCEP2krp4P0nHi:GDB7b0pTPD6nK6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879434, "uuid": "b14b3cbb-b3af-4fcd-9f1c-2ff483961066", "value": 102687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879434, "uuid": "8771d774-a901-4c31-bdda-0fe8f7d5ab10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879434, "uuid": "1357162a-868e-4aeb-b35c-1ab3e49f1afd", "value": "invoice-1637482117.pdf (96).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625a5acc-da8e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765896551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896551, "uuid": "c7e278a7-33ed-4af2-b942-0566a8c9850a", "comment": "Malware payload (AgentTesla)", "value": "7952ede2a57a6a33144840dbbea958fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896551, "uuid": "2af3dbe7-4824-4943-a9af-6b1af8e8e459", "comment": "Malware payload (AgentTesla)", "value": "3288945bfb12347cde8ecdce3969a0068c423cf93e598adcd7fe6d1b3e8e2152", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896551, "uuid": "9351cbe5-54c1-4f2c-8c80-b77bfb1c402a", "comment": "Malware payload (AgentTesla)", "value": "8723e12c1933c7629b201bfd445cf4417954ce52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896551, "uuid": "c273cc8a-c28d-414c-aa3a-d7e375fa256f", "comment": "Malware payload (AgentTesla)", "value": "a60f3c979d137c7c4cff7b709b641d8da75a1a7c2354bb9167de4605a9021675220a84facb36ae4dcc56a2028e1f6145", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896551, "uuid": "e5351677-ffeb-4f3d-b4d8-5255923f538f", "value": "T1A135BE0273C1D062FFAB96334F56F6115BBC7A260123AA1F13981DB9B9705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896551, "uuid": "ac9a5d4a-b976-42b7-a466-3031e0eb75b0", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896551, "uuid": "c8b92708-ab0b-407b-9527-70b2cfc2ecea", "value": "24576:j5EmXFtKaL4/oFe5T9yyXYfP1ijXdaJX0iLrfxH:jPVt/LZeJbInQRaJki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896551, "uuid": "a2c0b003-ad1f-4a6f-be24-31ddb86320de", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896551, "uuid": "4a1669d4-0af3-4be4-acf2-c9f5e3ffd72b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896551, "uuid": "062bd58b-8f09-42ed-969a-1e2d9fbd6ca3", "value": "DHL_Express_Rachunki_Elektroniczne.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2127120e-daa5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906320, "uuid": "8b1f18d5-5a7e-47bf-90e6-86c859c0fcbc", "comment": "Malware payload (Mirai)", "value": "c728be7df8a213abedc1fd9e000d572d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906320, "uuid": "85cd8dda-39ac-4b14-96c8-cb491b075870", "comment": "Malware payload (Mirai)", "value": "32b32578b3a384278c4116057d5273563b81e36c1b7269bedf6b23fc4be9db0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906320, "uuid": "63f5f9e8-ac02-40fb-9148-0f271bb7f9fa", "comment": "Malware payload (Mirai)", "value": "3ec99110ac80d76d8de9143e701a09ff18863686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906320, "uuid": "44e2deb8-2e7f-4da8-b75f-d3c3d2e16f96", "comment": "Malware payload (Mirai)", "value": "02850d427a184f0d4393652f51fe18c9b11136fa1430861d2528fdfc9c0b33d856349772a9220fe0238a2eda3c5ad003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906320, "uuid": "f310d1fa-a544-4e5e-9c30-3b9cf084767f", "value": "T1C5932A54BC88CA99CAC0667BFF8F43BC37164394D1EE7503E8289B55739B0621E3D8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906320, "uuid": "ed631fdb-7210-4369-baca-fac524c8ae8c", "value": "1536:7gP86R8kDszzyl7tvztDIdo+OGjWp/bzSk8oQq8nTo5ViiihxyGZ:7Ja8kDY2l7tedobGipzt81q8n85ViiiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906320, "uuid": "098feb9b-ab13-417c-b012-55f0d90f5d9b", "value": 95408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906320, "uuid": "007c6eb8-12f4-4e2a-b18f-52b882826f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906320, "uuid": "963cbd13-95bb-489d-a7a0-f503118f1aff", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099695ce-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765879652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879652, "uuid": "76ab9677-d040-4ed5-9734-95e4fa65f69c", "comment": "Malware payload (Formbook)", "value": "3856004ef83a2dfb6fa8365e920529dc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879652, "uuid": "4cf1ab46-9edb-4255-80c7-9b50e87e30b3", "comment": "Malware payload (Formbook)", "value": "3310f2425f21dfbc380df09f1bbb5a8dae92c25a5afe7835e0812b84d692d38b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879652, "uuid": "12566c7b-e33f-4a66-80b0-401f3a7ff70a", "comment": "Malware payload (Formbook)", "value": "8ac63e7026f6512c3cbe74ef16f25e203cbd4d45", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879652, "uuid": "52670ce5-090e-46c4-bda8-89f2bd5afc43", "comment": "Malware payload (Formbook)", "value": "cccf0d7b766c0e16a1e447d2c59d40248fff24d057d4e7cbdfe926e6a5f3e31e1db13644d77d3c28c7f35e430e83c30b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879652, "uuid": "bac593f3-500c-4166-8216-b5ff86ea290a", "value": "T1DF4343C83FD2B8B0536270B76D2BA06AF57E5C84B64C40E4D3A694D4F92C318D6B1B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879652, "uuid": "543557bb-6eb6-4cea-b5e8-2596b043d531", "value": "1536:DouobHtnjcW4WYnaj6RthgIofTF2SjEndm7305lpAI5Nz7:9g4WlZN7kxAI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879652, "uuid": "1ab805c1-f572-4e24-b1ac-c63d9867aa75", "value": 57777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879652, "uuid": "994e23fc-be44-4132-8ed8-c72be1643bdd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879652, "uuid": "dc4b72a4-cb7b-4f91-b68b-a05942534b81", "value": "Electroglass Ltd PO-7211-A25 Dec 2025 pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941fd04c-da9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765903077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903077, "uuid": "5a5370e7-f1df-4e21-b87f-babae94e0964", "comment": "Malware payload (Mirai)", "value": "62933a205de4db32a6d07abd3cb94100", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903077, "uuid": "404e3262-1799-41bd-865d-7945040afe9d", "comment": "Malware payload (Mirai)", "value": "3351dbb034f88632ef1f1e5b4cede3a5ee7696039a2bb793fb29d117c13e4b22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903077, "uuid": "108554b9-1c16-4710-bf26-492cabc1d088", "comment": "Malware payload (Mirai)", "value": "9d82b551dabcc1c92e7203b7347c77bf16b392fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903077, "uuid": "cf94e9a3-8aa6-4a1a-837f-a3aebe69492d", "comment": "Malware payload (Mirai)", "value": "ec94827ce571e8dae5182a311a1df479efbd9a540f4ca3723742284b345e8097ffd34d23919dc77600e002c3f89075c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903077, "uuid": "e7159508-1297-41ea-a452-d4a749ba1f9d", "value": "T115D3F745AD508F20D9E723BAFE5F128C331613A8E3EEB11ADC245F55738A51B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903077, "uuid": "e59814c6-0846-4b69-8b0f-e56cddbb54c3", "value": "3072:I20Sj4ab6rhhyk53A5BVUS3cTtDiMAubiWB4LqpVnp56JukD:I2uab62GAHVZ3cTtDiZubijLuoJuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765903077, "uuid": "19fc3e90-b737-489f-b6a2-d8d1b4af871c", "value": 135844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765903077, "uuid": "da0980bd-4fff-4153-ba73-dca2a13a3d28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903077, "uuid": "a248e453-498e-4211-ad99-3bbd5b1ccd29", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a071746-da89-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765894336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894336, "uuid": "85bd03d4-13dd-4f50-ae85-0836e715add8", "comment": "Malware payload (Mirai)", "value": "fae6a0c0b916c40703fa25d836cdb811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894336, "uuid": "eeb4a43f-b53a-4661-914c-ed4e9adafb8e", "comment": "Malware payload (Mirai)", "value": "33760cedcef17700c281964c2669d96e4117bf5db1dd961a555b36a3f0c5fbd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894336, "uuid": "5c356a0c-60fc-4c33-ba84-ccb572ee6d7f", "comment": "Malware payload (Mirai)", "value": "17914bfd33f1c6915b587ba829c0814bbcb19abc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894336, "uuid": "c48ad92f-8e9b-4386-a7f9-210ae18cf13e", "comment": "Malware payload (Mirai)", "value": "8f0dce219ca62dc1c065c21759c0d57553779fd4c739fc3447725e4ebd89b5066811a466d34f37a34b6735faece3a621", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894336, "uuid": "2b988135-473e-4e8e-b951-5a4ad3b740b0", "value": "T1ADD3E7086F615EBBD8ABCD3740A94B4A199C9407327C3B7579B4E604F64A14F0AF3CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894336, "uuid": "5df6dc64-5de5-4733-9e3a-8e12533b572c", "value": "1536:JqPqWv7+TZtS6oyPcoEkY1XB6UNdDP1IojmOpqFQ3pGzdX78nTo5Nyym5T:Jqv6tSwWcUjmmIdL8n85NyyOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765894336, "uuid": "3129e026-2c56-4277-b4d8-3ce24bd9db04", "value": 130908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765894336, "uuid": "aa9611b7-5943-45cf-a0e5-c30aee64aeb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894336, "uuid": "bcb50575-c7dc-4cef-8226-9fe408af7ea1", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb2e481-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879526, "uuid": "2861bcc7-c813-4975-8539-f3cdd92cd253", "comment": "Malware payload (Rhadamanthys)", "value": "6eb1184f0362557abe7d4e758799f5a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879526, "uuid": "a9ce334a-6a6a-40ef-b18e-97a3c983599f", "comment": "Malware payload (Rhadamanthys)", "value": "33d03518339aecfc6340cb2c11ee982a3ca8fcadceb0a22be5688a88f5848759", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879526, "uuid": "925b7ca1-907e-4250-8eff-2f415643abeb", "comment": "Malware payload (Rhadamanthys)", "value": "b489a189149236156eba9c7a6534ce161c4acc31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879526, "uuid": "6bdced00-e697-4201-abd2-0e16528f5380", "comment": "Malware payload (Rhadamanthys)", "value": "c3c6ca06c28f874eb46a7028d8fabc4cbfb39d47cbec8e72dd6b4a2e12683f71c8734095c3100efe55f5ea57708b4e27", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879526, "uuid": "94eae6c4-7ac2-4e3d-aa52-d32905d3663d", "value": "T181A32A4336239DE42B7BAA51EEE84536DE97584A81C2E4B08C9FAE791414B30DFD0DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879526, "uuid": "e4bc3b13-d731-488a-8148-60a4adb365a1", "value": "768:GDhd0i7J4sYKgY/CMNfWdV1dcSKtaAf36qZGsFCIrAXVFMHfUiGrh0caj+amAf0+:GDB7eKg20hrhrVdkQKAH7H6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879526, "uuid": "67aa0203-7a41-4e3a-93da-5df44e66523c", "value": 99389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879526, "uuid": "4fd6cbbc-0427-4194-9709-43251ab23883", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879526, "uuid": "346592db-cb7d-4166-bc41-9cae3ffb2ea5", "value": "invoice-1637482117.pdf (82).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea2630c-dab7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765914128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914128, "uuid": "634287fe-bdc6-4d80-a746-e82916c2aa2a", "comment": "Malware payload (Mirai)", "value": "6072ab53fdda39a89e23679f591f04d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914128, "uuid": "db99adef-e622-440d-b5e6-a6eefb01f589", "comment": "Malware payload (Mirai)", "value": "362291d833c507d7bbebe5465b68af5ff6e4c2721c030a8400b58ff2f55444c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914128, "uuid": "0a6de000-2186-4284-bcda-23e2b40f65b1", "comment": "Malware payload (Mirai)", "value": "2210433e458d47a081be59b1137e0e619ae1123f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914128, "uuid": "65994037-b952-4517-9ebb-4ba23627e845", "comment": "Malware payload (Mirai)", "value": "ecde787868f320651000d2f16ccf80b99a67e8dd033826e3f89d2dd50f25179b0d88ae67a8e10097af831c5cf2b043e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914128, "uuid": "7a293a76-65cc-46e5-83a7-b3236227f4ee", "value": "T117E30745AD409B25C9D722BBFE4F119C331243A8E3EE7117EC185F56B38E91B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914128, "uuid": "e71925b6-2de8-475a-b209-a9c431043172", "value": "3072:fISxsYY1IVRYcVdHG2u7jwN5ad9M2ru6qgfdKT6oQVnKz5:fISSYYiVRYAm1ja5ad9M2rFqgfs6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914128, "uuid": "19f046d4-e289-42be-b3b7-7d485d054285", "value": 144744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914128, "uuid": "15f752ce-19be-409c-a6df-fffdb9893871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914128, "uuid": "d1309b31-fab2-47d9-8882-2d97f3bc3c76", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c9fb0a-daa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765904817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904817, "uuid": "c740015a-109a-4389-a4d2-cbc5b0bceb5b", "comment": "Malware payload (Mirai)", "value": "5c118deaae2e85d34590769da86b0b06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904817, "uuid": "1723a510-7b52-4836-97e6-8648e8ecb2f5", "comment": "Malware payload (Mirai)", "value": "363cab854de4e9e693c4cacff1862b822fc9801ae31cc85811453d56d72bbffb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904817, "uuid": "5fbbfbe3-4444-41c4-b037-0623a1c83ca1", "comment": "Malware payload (Mirai)", "value": "8c54a5880b8b1c33aed1138c526590860b7e0128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904817, "uuid": "c35ab263-17e6-4550-b38e-ce946535e528", "comment": "Malware payload (Mirai)", "value": "3dee807d87c57894b14b162d8a7203cd44e247ac2a5dbd822ae01f0a0a5a9703b663b7018378617e780299b1045eabc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904817, "uuid": "d54b5fea-1a4e-4400-8c37-7a109923b353", "value": "T1919318547D419A1AC6D4237BFE9E039C376653B0D0DEB01FEC202B95B39A2170D3A99B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904817, "uuid": "92501d59-15d7-45e9-b043-b09b29dd1de1", "value": "1536:6fs4moOW3enwu5D4wNEfZejR0PeFzzAtGqzTbCh4vA7w8nF56yyy:6fs7/DAejmet8vzTbChSQw8nF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765904817, "uuid": "e7cb65ed-a260-4d1d-b4f9-7a2a35bc2dbf", "value": 89548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765904817, "uuid": "b2ee975e-5282-4325-ad49-066b17055d2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904817, "uuid": "8e6adfe6-8124-47e3-ad88-0da330d073b5", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c258a585-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879533, "uuid": "f6143ab9-1bab-43dd-a27b-0bbb91462450", "comment": "Malware payload (Rhadamanthys)", "value": "72f41703b45e5d98905439e888e6f59a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879533, "uuid": "7255520c-ffcb-442e-b677-218343f382e3", "comment": "Malware payload (Rhadamanthys)", "value": "368248728d524f1b995de325d929619ba4adfb815fd74b1d4880140732375996", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879533, "uuid": "3bb6c30b-e0ec-4bf4-ad47-f21cbe645b2b", "comment": "Malware payload (Rhadamanthys)", "value": "bc82cb1a7d2d465df1092a3f33d1b7c75b083168", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879533, "uuid": "cc2b655b-a4b8-4c54-8db2-500bf5f92577", "comment": "Malware payload (Rhadamanthys)", "value": "9d7904de90689152c9658fdb0bea810576dd6fcadf18be6e06ac6eb530305a3a44610cc908a8e9068eb5b2a383a06f10", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879533, "uuid": "b57b4501-28d8-4017-a136-fb2ffa6d4da9", "value": "T1D793F800FD2786C01383BAD96ED559ED5569D38C3D3216039B8FF77475AAB292E20B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879533, "uuid": "572a1475-c8e7-4b32-b295-dc46db20b5bf", "value": "768:GDhd0i7J4sYKgY/CMNfWdqtrX+7rZVE0H7nKKgAQ1H2SLAuAAroQW+FF+Ec+0FO1:GDB7eKg202rCrZVE+KAQ126BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879533, "uuid": "a208d72a-5380-45d4-8102-b3db735bb4bd", "value": 96760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879533, "uuid": "d236cca7-0725-4e67-9ad2-4e801859e0b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879533, "uuid": "f46810b3-c45f-4c5a-89ff-b50f2c6d135b", "value": "invoice-1637482117.pdf (81).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be24198e-dab7-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765914315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914315, "uuid": "71dd36ad-822e-4f23-b84f-6a22fc61691f", "comment": "Malware payload (Gafgyt)", "value": "4e31efd207856078857ef5dbfcca95f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914315, "uuid": "7a4e7e0c-9fcc-4ea5-b540-ef96b0f0ea80", "comment": "Malware payload (Gafgyt)", "value": "37b09e3bb8d9589ff4e587ae5272880fd3890bd0a3598ade2d7bb0ccf8873156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914315, "uuid": "2c402a66-09c0-4f48-a272-f9fd3253f3c9", "comment": "Malware payload (Gafgyt)", "value": "436eaed96483b2f2a8d6be38a754aed1a3b77b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914315, "uuid": "051a1691-3c47-4582-9f84-db292d2da744", "comment": "Malware payload (Gafgyt)", "value": "437cdc5f6680b3f80eb2931988591a9d9c262b756e890cc01c32d3a3b1dee70204508b6f396688fe4f5f64167d2952df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914315, "uuid": "8bed1501-0b38-47be-b89c-0df68248ae5c", "value": "T1D7934CE4EDA3D6B5E865057240F24FB78B34F93A016CEE4BFF685970DC502018296BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914315, "uuid": "7799ec16-e0ee-4257-9572-fb4e3c21c5d7", "value": "1536:1THUVO6wEbFUR6DGzNeVYzyU10sRmK0aFyZNJdzxqLFVYSI+o6LoDu:lHUQ6PbFM6D7QL10fKbFUrFxo5HjLoDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914315, "uuid": "7da525f2-e37f-4c47-91de-d7c1c71a938c", "value": 90768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914315, "uuid": "85671ed8-50ff-4d48-b8ad-d915b8d54085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914315, "uuid": "db42b027-d426-42b3-a3c1-3c2fb7b1d5e7", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f636cc-da44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765864775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765864775, "uuid": "1cc4a1db-f069-4eba-b47b-9e6d3871d690", "comment": "Malware payload (Mirai)", "value": "02abf111dff09d31092b515621eff852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765864775, "uuid": "cb1fd45c-3e44-410e-876f-63a948e6747e", "comment": "Malware payload (Mirai)", "value": "384d584a7f02d27963ee10cbf41cf2f1bb99f4c3c0a8ba49ee505e97c46e294b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765864775, "uuid": "a09cc81c-669e-4dfe-9f84-af0f1637a509", "comment": "Malware payload (Mirai)", "value": "d230c8b8a400aabf25861e4ecf833b29b073a157", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765864775, "uuid": "ca08c0a3-debb-4e08-b33d-9226ed030a34", "comment": "Malware payload (Mirai)", "value": "e5c846914bd06190a16f8eeaebc5237e26d1551a713a7e9e85299a85028419a5f4cd61734b60e014b274a96eddbcfcb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765864775, "uuid": "069d9bb6-5eda-4c0e-a310-04df88aeb5cb", "value": "T1D2B31905B30C0847D2633EF4373F67D197EFDE8121A4EA40255FAA8A9172E32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765864775, "uuid": "2b1e7940-178d-43ac-9eab-ec7db01d724a", "value": "1536:A4ASUxXk06AqSdkSoHLvAydNYic5Q7X4aL4/PLVL/9AG:fAFxXRkhHMyXX+57iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765864775, "uuid": "9ca27a4f-7f33-4966-b037-61e28db41c19", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765864775, "uuid": "9633543c-eacf-4616-a3fa-e35be1a06cd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765864775, "uuid": "58e26d76-a03d-47bc-bbe1-15711c81c549", "value": "nuklear.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c579b0c-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873858, "uuid": "aeedcc03-937c-4537-9c50-3b2df2b9635b", "comment": "Malware payload (Mirai)", "value": "daabc81df4dd4ff2f1ec101fec163a84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873858, "uuid": "00880c85-d474-41e7-986d-416b9de4629f", "comment": "Malware payload (Mirai)", "value": "3872eda84bde103dcf606b634c7ad9567eda10e19948919c0f2cb611c5d87af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873858, "uuid": "f4f0f437-22d2-4e4e-a822-e9eb43482080", "comment": "Malware payload (Mirai)", "value": "0c2b7ac90b015580c967d738b7dbccbbe334ed80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873858, "uuid": "8bba737d-3987-44b9-9714-50d58cc3aef9", "comment": "Malware payload (Mirai)", "value": "a1fe850e070fada40a3b8dfb506578d7d8c6d3ab802907b9f95c7054a9c842a0bd11946fc2d1dd9f7ab4c97bc633bdd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873858, "uuid": "495c5dc1-2cc4-4bbb-8fd1-c2a034045103", "value": "T1A143089AB9C28F15C5D412BFFE0E118D3313676CE3DE72139D205B246BCA56B0A7B816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873858, "uuid": "75d9e9dd-ae27-43bd-83e1-8b367c762bfb", "value": "1536:TknPV/Okfx7cQS4YLcTMzHIZikfVi1Xj:mVG2ZQofVi1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873858, "uuid": "a98035db-1895-43ec-80fc-a4cb0c022912", "value": 58752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873858, "uuid": "3abcac63-0ce1-42fa-b073-14b8c76b6c0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873858, "uuid": "615e0463-9703-4e35-ad00-4c1aaec2b011", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e8363a-da1a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765846836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846836, "uuid": "ff4d608f-fa1c-4996-84bc-d9936beb143b", "comment": "Malware payload (Mirai)", "value": "2fd1324c5cf6cbf3986c0e09e7ccfad7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846836, "uuid": "e104c5c0-a3fc-4f5e-9fb6-138d63d7f0a4", "comment": "Malware payload (Mirai)", "value": "38b351e6545793d4b4a604d3bb984737793a593490898a6826b3f96878ff6092", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846836, "uuid": "573e443f-f9ce-4e3d-acdc-bf2632bed7ed", "comment": "Malware payload (Mirai)", "value": "9a277acd71e67317e68571340476bc010e99c538", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846836, "uuid": "336265fd-8bfc-499a-9758-a5efd95ad19c", "comment": "Malware payload (Mirai)", "value": "edf231668965aac0d510d8ee47442a429ddc11097b1a8154acdb162b90789de1a9ecae1e179754511daed96295497633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846836, "uuid": "023abd08-0814-45d1-a5c6-17d0ab10e160", "value": "T1F4A38D66819FECE9D3A90D7A24A1C938D799389025432FB5A7B8C1F40083D7BF58F365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846836, "uuid": "d228d37c-b303-452f-929a-04470af9370b", "value": "3072:VHHdFKOovqqwdgLCeQWJwrp+8lkOopCapV:VHmTqPykOw1+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846836, "uuid": "d01a73c6-452e-481f-ac4b-fda06954facb", "value": 106100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846836, "uuid": "22563874-d7e2-4626-8619-9e4a0ea44647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846836, "uuid": "c74f84ee-647c-4fae-8bb0-51a19a06c402", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77128e95-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765852777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852777, "uuid": "b9ee5a4d-58b8-493f-8ac3-b1d91a9915d2", "comment": "Malware payload (Gafgyt)", "value": "2d5f1840ee28b7608e6459b559cf6c52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852777, "uuid": "f3749fc5-f1ca-448a-b8e7-f11a5d1072e7", "comment": "Malware payload (Gafgyt)", "value": "39003fff70b07fcb446b9f32adb0455dd209abb4434260f37fbdfc67f48d97cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852777, "uuid": "e6fce05d-7202-44c5-bccb-375f7935868d", "comment": "Malware payload (Gafgyt)", "value": "ff44e6d94a73ba182b49dee7e33a8e3b3931224c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852777, "uuid": "9898afbe-f76a-44eb-baaa-619b52bad6c8", "comment": "Malware payload (Gafgyt)", "value": "4ccba4f6ca935cf9b5a68b82033419886d1bd479bebdc4d7ae99c4b545e70efc8d9c1a3d25a08d5eee68470e736efe43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852777, "uuid": "7f4a21e0-4a75-4b0c-81af-3fe1ec7a5179", "value": "T15F934B17BB1D0B53C49B6AF11CAB3BF18769FAE112D26285620EAFC44733AF02911F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852777, "uuid": "95ca81bd-ac95-415e-a03c-05264ca90568", "value": "1536:IwHJoQLXDxRX8zHcaN7IwRoCobrUg2hiDmBeUmX2VMDrUuKfa5X:IQmQXxwHcaNUs5Z+mBeUmX2VMDrNKfaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852777, "uuid": "1822ab75-68f2-4dd8-a9cc-bce51b338bba", "value": 95320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852777, "uuid": "ec9e7a24-63d5-4be9-bbbb-3b32a8aae16a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852777, "uuid": "73fd524d-3a26-4138-83b0-bef883875012", "value": "Fantazy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c92e553-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879818, "uuid": "19f32434-1907-4b89-95a7-9c667eedaa7f", "comment": "Malware payload (Rhadamanthys)", "value": "6c0f80878d746b6b393e2d6b15bff646", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879818, "uuid": "aa43675e-cd39-412c-aff3-5b131ed9780d", "comment": "Malware payload (Rhadamanthys)", "value": "3928b6efa685875dcf2bbd3c59b0abfb21a94c529eb02f942e4ed92d78788c9b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879818, "uuid": "aa64d2cb-e3f6-429e-b858-07bea37fed7c", "comment": "Malware payload (Rhadamanthys)", "value": "911f1c44e3e3853a4101f571a0592d22935a26fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879818, "uuid": "7deaabc7-3c52-475d-bba0-921f2fff9ebd", "comment": "Malware payload (Rhadamanthys)", "value": "2ecc4b1f80b15ee63d69755b15a54b9e653f1d04efec517a285b93d72fc9213575053583fa9c7428b17c7f53d917e5e9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879818, "uuid": "ef10ac78-a8e4-4d66-9d39-c9f8fc947372", "value": "T18A933C887FDB5EE4B3E6F959AF0AE393C4ACD1D10085102DA627BF368126E6554F24C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879818, "uuid": "b994f3d5-90dd-418f-a008-163ad0476959", "value": "1536:GDB7eKg20KB3ZY0IA9rPWwbh/7OPuLbISbPPjxKr0rjMPrVb6UGr0m789Q155615:GDB7b0hHHqo0F6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879818, "uuid": "2f71850b-02e5-4478-b3d1-4da0bf89adb7", "value": 96126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879818, "uuid": "0c883146-2440-44c2-9e65-c89bd040f5ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879818, "uuid": "9a9f1acd-d909-41a0-83d5-7842a9a901a7", "value": "invoice-1637482117.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f42719-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926917, "uuid": "95c11c41-152e-4d8b-a4c3-6158a746d20e", "comment": "Malware payload (Mirai)", "value": "85b3ba0500f1cb0ca1a6f087980fbae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926917, "uuid": "233fffe2-e3de-419d-bc5b-07536fb6b1c4", "comment": "Malware payload (Mirai)", "value": "394486579e8cc6232699fd32da6ef0083a4518b7cad4ee5bfd40e1205c231783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926917, "uuid": "de413479-7b4f-4569-aea3-d88ce9b4cb58", "comment": "Malware payload (Mirai)", "value": "88aecceecaf80145f9777b46da731044894fd0ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926917, "uuid": "6cff2aa3-9cc4-4331-bdfb-9ba062dc155c", "comment": "Malware payload (Mirai)", "value": "b01aa86d7acf908c14968f7e37de8eed1802f28eb02f4081712c27ab9d1c089cdf2e221b4cf79ad131491b44baf13ec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926917, "uuid": "65ff1a49-3e18-43a4-983d-d799ec660f05", "value": "T149C3A40EAE319F6DF2AC53B683B74F20CDA523933AE1C941D16CD9109D74329A41FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926917, "uuid": "3904c144-32be-4d2f-b4a1-abfe7236b214", "value": "3072:G7hmogRsh/JTwWkVUa76F0rac5EXDsiBtmlt6JqaBmoVF/RDJd3eU10o2z3IVOwM:GdmoHvTHems1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926917, "uuid": "eae6ae23-5b52-4a54-924e-a5e21d3e92e0", "value": 118484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926917, "uuid": "36604b84-aa41-4a63-8421-7d177c0ae2a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926917, "uuid": "6a90f552-d102-4b10-b5d2-96719ee034fe", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2758a51a-da93-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765898600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898600, "uuid": "f9e037ff-37dc-4df9-ad6a-0dcb6435726c", "comment": "Malware payload (CoinMiner)", "value": "6e8d49f925c4f7666881c94353c4cee3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898600, "uuid": "6d2c9652-ce33-43fd-84b6-2ad91c42e907", "comment": "Malware payload (CoinMiner)", "value": "395a68f5bcfa421b2dbdc7b51ea9237451193465c3e9fe095f522d127583727c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898600, "uuid": "a789e751-b3ec-47df-b66c-e7ba30037288", "comment": "Malware payload (CoinMiner)", "value": "b7bf255fac02bedc8c87d6fe0000d54e384da1ac", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898600, "uuid": "936a23a5-787d-44df-bbe6-43c811e0bdb7", "comment": "Malware payload (CoinMiner)", "value": "921992899ddfc86b2cc653c8a2ce506d18b02e32ad299cadc5673b08ca8198ba4af411c93114fbc5a63aa959b4be2d7a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898600, "uuid": "f9bda2d9-840a-4d16-9168-622f127d3956", "value": "T1673733D2799AB22EED710A3D58383585863342C8E9A7E7BE07A7DC3F1D55272243184F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898600, "uuid": "a0332d05-f4f9-4ff2-90c3-a429d184eb3f", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898600, "uuid": "e617749e-d93f-4920-a663-3190a18114a3", "value": "393216:C8adR2pQ9l8VJtZqf3n5Jt2E1ynizyjbIFRCZpJKP1S11RB1/tWxTPm:tbbJDM5JtR1ynCF8wP1S1dxtsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765898600, "uuid": "4d705ef6-be4e-42c4-94af-6357e23c02d4", "value": 23505920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765898600, "uuid": "095a0fc8-f56f-4df9-b12f-b628674b8571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898600, "uuid": "71df1097-0673-4d16-af85-01c9c593cbc4", "value": "Installer_v1231_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fe2b3c-dab6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765913632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913632, "uuid": "dc34f2ce-dcb2-4f53-a594-c70f0c994738", "comment": "Malware payload", "value": "51fdebf3ace8ae5e7890eddf0e7c6665", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913632, "uuid": "74b59d37-0725-4274-b526-40f13087eb1c", "comment": "Malware payload", "value": "3969d9f842652b5809c1e503e1eaa58c421dbe985bbe0c14491d44a4548cb286", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913632, "uuid": "0df30a1d-46a0-4347-86fb-93917a37e2d0", "comment": "Malware payload", "value": "73493a89aa244b389e13351ac27e68712a4e669d", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913632, "uuid": "c7118a58-48b2-4daa-8b29-82ea67f9eb9c", "comment": "Malware payload", "value": "e142e9ce32994ed0557a4cfd1122347ac0792125565e3084ba522f7a8842de21cdda7009cc0af533bcf0ac8b9b032632", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913632, "uuid": "c8877dd8-3224-4275-beb6-24c1f8d90481", "value": "T197D35C67C89280F4C82AD5788ADB922F79B7B491123D358F5DE09F061B76F60F31CA49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913632, "uuid": "4ad5255c-c038-41af-a1b4-c854225c1bce", "value": "dd5eaf09d8623688596c2c73b0c03622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913632, "uuid": "a9abfb74-517b-4f97-aad3-f772d410bc89", "value": "3072:fbpTbw9IrB4R49G2FY+M5bJrIhtyz2yv9Eh34V6d0jLo2D:fdTbwKg49NF98ihtA2kCOr3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765913632, "uuid": "09359bd9-3368-443d-8aa9-3d29834688a2", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765913632, "uuid": "e46a62a7-b132-4b25-8cc9-913add2810e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913632, "uuid": "4408170d-d7ca-4ff0-b20d-39d895ee7afe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1bcd01-dab2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765911974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911974, "uuid": "76e7179a-37f9-4aa6-814d-eda2b71eb044", "comment": "Malware payload (Mirai)", "value": "7a850f19265dafb247a81f7a7c0c13b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911974, "uuid": "c90ed47f-3968-4029-97d9-9bcb22ac4856", "comment": "Malware payload (Mirai)", "value": "3981ed03f37107dc257154d6f61fa07b33810e279e0b3ee7786d137c499a7e0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911974, "uuid": "8d4aa2b4-7407-4d41-b4f9-d63c5ce4d49f", "comment": "Malware payload (Mirai)", "value": "8bca3450234fe49e91dec2076706b73becb982a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911974, "uuid": "b8d26ebc-359d-4a9a-9d67-15118fb0325e", "comment": "Malware payload (Mirai)", "value": "55998301465e16b5d74520a4dff5385a9c0bb0f855e58b304d0f6ef4e3784f585e6bb8c20419ec147335c6c0982aceb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911974, "uuid": "6b8145ec-43c1-48fa-9a51-42f6342f6375", "value": "T19AC34991EE82E4B9EC050478707A5737CA34FB35011BDB87DFAA9D70AD81201D669BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911974, "uuid": "1e3e0640-5333-40e6-bb73-cc639ec01263", "value": "3072:TxPZ2UaYkNS5QoytIr1aJXJCQFwTvicfKKPQjOMUOvoD:dh2Gp5FG8IXJ7FwT6ciKIKuvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765911974, "uuid": "7c385eb5-6f8c-484c-9ec2-499926e606c0", "value": 119760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765911974, "uuid": "434d03ad-7a33-4082-be64-088ea10a7280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911974, "uuid": "780b73a9-260f-4dd9-b516-9817abeb616b", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f3ee67-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879450, "uuid": "cee67bc9-76c1-4fe7-9914-b77a91c4f3b1", "comment": "Malware payload (Rhadamanthys)", "value": "5a2dab692e6d36b69a68be0e3e8f7138", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879450, "uuid": "45a3a966-3691-42fa-aa89-1af81bdfa26b", "comment": "Malware payload (Rhadamanthys)", "value": "3986a2bbb050783e53b1564d184c706bfb0b3d14045281b921b0b9b54c94105b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879450, "uuid": "8f687c47-4c89-4f2e-a610-3006d1402c93", "comment": "Malware payload (Rhadamanthys)", "value": "535cf371a05bab83807b1fc02f7e72854ebcaada", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879450, "uuid": "926fa2fe-5429-4109-a8ec-3f2b7d909cc0", "comment": "Malware payload (Rhadamanthys)", "value": "ec7b08d2dc43ee3fc890e5475ce9d8651ead29cf567c06d1bdd3014815c26cc9d04819092b9bbb5723c83276fa49b66a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879450, "uuid": "e13a6752-bee5-4635-800e-163bdfac9f70", "value": "T160A30C89F5225DBE122759DE5D472BF8DA21C3066222654E204BF7F33242F71AF49AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879450, "uuid": "9149ce7e-bf94-4900-a2a7-47beab10443a", "value": "768:GDhd0i7J4sYKgY/CMNfWdioGMyKqfdrX75rs5bEVaH5jQgGAjFUp1tBSLAuAAroU:GDB7eKg204RrFrs5YqyAEvB6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879450, "uuid": "38348879-2d00-43ac-80f4-e0165b8b9ec6", "value": 99436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879450, "uuid": "841bb507-62aa-4be0-86ee-2f033ba4946e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879450, "uuid": "b435c63f-432b-4f18-a28a-6f8f1344b3ec", "value": "invoice-1637482117.pdf (93).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dfb4f1-da69-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765880721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880721, "uuid": "0ac91d0b-2d2f-4287-ac05-9caf8f07160d", "comment": "Malware payload (XWorm)", "value": "a3192f3483d2ce4f4024797fbba58345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jblakibk-duckdns-org", "colour": "#0AB135", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880721, "uuid": "96b91358-6a16-4591-9954-09b89de51138", "comment": "Malware payload (XWorm)", "value": "399a03fc781e7c14ce64eea58950406192fd7f5a78db1ba742a44e57d6b47cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jblakibk-duckdns-org", "colour": "#0AB135", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880721, "uuid": "d4f513be-f72e-4343-90bc-42c636db0cab", "comment": "Malware payload (XWorm)", "value": "469bf26d2b4300a3a5662f3f0835756f3320245c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jblakibk-duckdns-org", "colour": "#0AB135", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880721, "uuid": "275526c4-ef98-4eb8-804f-aec453782faf", "comment": "Malware payload (XWorm)", "value": "899698aa03c101b93a05e99b02b13d1e4ad54aee1a69760e192e6c5b93f4f964bf88041fa79e3cdaf7b75cca9ba92332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jblakibk-duckdns-org", "colour": "#0AB135", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880721, "uuid": "5ae0b5e0-2291-4e8f-bacf-645615761f70", "value": "T144620816DADAE531EA7E06312DA1D2348733BD929E3B4A9F48CC4D43772F32019A1F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880721, "uuid": "6a590323-61ac-4032-af66-3d8526a286f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880721, "uuid": "bc6466e5-3067-4017-97b2-0d928273d768", "value": "192:3vG1m95NbuZzZNF7moS77ZQNkV/ZW0TIo0bxSIC3Lk6PaYTwh1zCliG:+o984pV/0LbQI8LkLnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880721, "uuid": "d7b52b4a-8eaf-4a22-b4b9-a66d278f071e", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880721, "uuid": "b207ff7b-9054-4207-b2e6-728de9418f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880721, "uuid": "e1c20539-b8ce-49b1-bec2-5c6f036bd9ef", "value": "399a03fc781e7c14ce64eea58950406192fd7f5a78db1ba742a44e57d6b47cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352b66d3-da78-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765887027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887027, "uuid": "e2f4b6dd-7455-43f8-bbaf-d9cd0b7333b3", "comment": "Malware payload (CoinMiner)", "value": "6cb4ccd1a67e5303db2e73a7a5efaf90", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887027, "uuid": "66f211ed-7abb-4c4d-af35-6317c27c5234", "comment": "Malware payload (CoinMiner)", "value": "39d4c1579f5931e1ca2683b2eb54557599601f3db2d1d7805a11ce59126d487c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887027, "uuid": "c4361af4-b676-4cc7-b48b-3b05fb3d5884", "comment": "Malware payload (CoinMiner)", "value": "5b7589b8d5e5d17e1d7c8c46d500ed7dac2abced", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887027, "uuid": "554e27b2-bb41-4507-bd1c-891221925fe2", "comment": "Malware payload (CoinMiner)", "value": "4887468a7520c409603f59852a872cfb2993b9ee1c25bfe16f803fcf034b555de5fece8c14865de33b0beb3ef6e85a70", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887027, "uuid": "244545b4-aa0d-4f57-8000-c619a19b247e", "value": "T101773389E622306BF42E7839D6B14129EF807E6FA0D5457A7114334666F77F632FB208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887027, "uuid": "6c049d7c-8fd7-48de-9bf4-3fd1b2e5a01a", "value": "786432:PZE1CEMkAt6DT6nkY64grIwrXS1ulz3o/UCnx+1c:PZUCDptoH14grI8dlk/UcQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765887027, "uuid": "71b43723-7cd4-4640-b81e-e98248887337", "value": 33644544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765887027, "uuid": "3018933c-0931-4819-b10a-8b33c1f521d1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887027, "uuid": "9fc5eec9-0da6-43be-b4e4-f7baa005283c", "value": "Updater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09825665-dad7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765927756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927756, "uuid": "63aa8b8d-3444-4c02-8bec-69d9245361cb", "comment": "Malware payload", "value": "ed939244243498080a8458099e4f839f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927756, "uuid": "bab73ee0-c30a-45f7-9467-eb14eae957dd", "comment": "Malware payload", "value": "3a9d2e85a70570555aee7ed2665324fb358e5c617b232bd3fbbc0e72dc16dc8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927756, "uuid": "c1344e94-4911-4f2a-94c2-41458013ddce", "comment": "Malware payload", "value": "36dfdfaf628a8f462e2a53d9322ba95ba238f8b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927756, "uuid": "f2826648-a790-45cc-b8eb-1c090dcb87f3", "comment": "Malware payload", "value": "bb5a1cf2dee731393f5bb45921f65bb390da78f5cb58471c0cc05053a16f402783816697abb34cab42f6bff902067384", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927756, "uuid": "8922fbad-30e0-4674-a3f9-60a5c46e741b", "value": "T16DB3EA1A2A61DBFDF159823487B3CB7556D4229127F4C389E29CDA082E303CE6C5F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927756, "uuid": "ad50db97-4129-49a8-8379-4eea9877ba16", "value": "1536:6OkdoHPjIpmkQnJXZT6pO32YsSh5nF4VDXOKdqAEYnvqc9GsPgNrWhE/I66Mjb:6HoHbIpCnJpDiSCDXddqY8UCI6Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927756, "uuid": "9246f14f-9b44-46d7-a0ac-9f9976c0fc94", "value": 112415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927756, "uuid": "ac885678-279e-4830-af44-8ae9e6a03c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927756, "uuid": "913260d2-a1bb-47bf-a827-ddb184b59ea9", "value": "n2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47ac01c-daa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765904823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904823, "uuid": "cc2cca0b-a0b8-43f7-bb69-d5e4b118e2cd", "comment": "Malware payload (Mirai)", "value": "664dba69bf6f918784dd5d8977f7c0d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904823, "uuid": "ea3658c3-00f0-40dd-bf88-ed147818bc7f", "comment": "Malware payload (Mirai)", "value": "3abe326cb2326ed1a57916d322fb951ceadfdd0a88e226e753dc8c9c93adaee0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904823, "uuid": "0bdc67db-ee7d-40ec-941b-6deec2bb021c", "comment": "Malware payload (Mirai)", "value": "7b2d7a6fe870e926f8b78c1c04388d2fc252b413", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904823, "uuid": "506e5c2f-39ce-4d16-96f0-57a51f9c7947", "comment": "Malware payload (Mirai)", "value": "8c439ffed12405e56d119d7705723089773c1b3952166dab4269fc2151cf0ccf8b7f470fb6dfa9663d74ef60e96b16a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904823, "uuid": "f3745a70-fef8-468e-a3cc-1e5c676d5417", "value": "T189C3F785AD469B11D9D763BBFF4F518C332303D8F3EAB21698246B55738E1270E3A846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904823, "uuid": "5d9fb61e-19b6-462c-b96e-c6d9762f84fa", "value": "3072:N+SF9S/qBKYiKNoZ7y/vHskKOuY/WQ7QiZ4Zh3Vnp5:N+SO/qBKYwg/fLKOuY/z7QiOZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765904823, "uuid": "fbaa14fe-e15d-4d82-90da-301ed428a531", "value": 120152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765904823, "uuid": "f725a9ac-bca5-435d-9374-492f5792d89b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904823, "uuid": "1ca8cfb1-3bb4-4ad7-8a8b-b351899dfbe1", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87583a40-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873850, "uuid": "540b3f2a-df90-4e1c-920a-b5484115e907", "comment": "Malware payload (Mirai)", "value": "7538c522704aedc285ed581fa6cc838f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873850, "uuid": "189e9e0c-fd03-4ffc-8684-e59d863fff2b", "comment": "Malware payload (Mirai)", "value": "3ae65c81b6bf326eb41d70258a513b39ffde6f1ad9a978121247414bbc13c806", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873850, "uuid": "26925ee7-ae60-4856-8810-499165e1ee7f", "comment": "Malware payload (Mirai)", "value": "4501b2dede3af1a812fee3ed93ae5da7092174ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873850, "uuid": "0ecee9c0-8253-46bc-9f33-f9b065f77df7", "comment": "Malware payload (Mirai)", "value": "99b6121f44dc179fd4edd0332d62e7792d1f6e9ae9f8171e1bdfb385f1a468e7d607e2a9eca9975d3ec4185d486c4d5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873850, "uuid": "ff563d1f-ca1a-4890-bec7-b2b3bade5358", "value": "T1843308B51516F2ACE9E22078F40720F529530A2C3ADCE2D3B0930575FFB5B4CB96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873850, "uuid": "3d21d06b-c47e-46b4-9eaf-bc3946996e28", "value": "768:z4khMqB4y0uqn3asAlnQZdIte4zA/iTl77VIlw0XRz:z94Kaqs2OCte4EOvye0XRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873850, "uuid": "eb8443bb-64f0-4ae5-9b8d-42ad40f7c37e", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873850, "uuid": "b77d778f-c19f-42f7-bc83-de32e1ba9125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873850, "uuid": "18d23381-0865-4366-a7a1-6dec1fbadf52", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271e6304-da70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883567, "uuid": "8b650d83-2420-403f-a37f-336445e73dbe", "comment": "Malware payload (Mirai)", "value": "59cc0a277ee3a71bb259a13b6218e5e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883567, "uuid": "eadadf66-11a8-46c6-9c5f-4dfba285e349", "comment": "Malware payload (Mirai)", "value": "3b35b376346a517fccad7544f82131b179bc858f21b47b9571e73c27a382239e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883567, "uuid": "13bf73d1-f936-4ab8-ba77-0ec60eb76864", "comment": "Malware payload (Mirai)", "value": "a40fd35e9cef90a2617f26b5bf782f0be5011bb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883567, "uuid": "82eaa4a3-3c82-4c8a-8ddd-ea3c0aead3b8", "comment": "Malware payload (Mirai)", "value": "7f7eed3bfed2d5762fcc88a3d36a8e5993686c43c8f1c6ab6be9769128a5cdeeaca11897c91db703b45ad00c564b2f2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883567, "uuid": "53f20e5d-d231-4f8b-a668-5dea15097f70", "value": "T13F9329187D418A16C6D4237BFE5E039C336753B4D2DEB50FAC253BA1B3960170DBA92A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883567, "uuid": "f374dd6e-5d7b-48e2-b6a2-fbad9c8cf96a", "value": "1536:LtjZmjOAWCDsluwmpHTDvkbxHpzzlkT60wY8nF5fBBB:LtjcalG7kbJxhkm0wY8nF5fBBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883567, "uuid": "2a561227-91f7-423c-a6a3-95ae384e36cf", "value": 89564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883567, "uuid": "b484b618-16a5-4637-a274-d079f8934b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883567, "uuid": "92790178-129f-42f7-908a-28c6b0b42ed2", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffa41db-dad7-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765927954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927954, "uuid": "d4c81306-2867-449c-a11e-382ed0418220", "comment": "Malware payload (Gafgyt)", "value": "389f9feb23f8fdaf913e0626bf50a955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927954, "uuid": "fbf9b82d-502d-40c8-866d-36a526221da4", "comment": "Malware payload (Gafgyt)", "value": "3bcc5cbcfc30f9380af59a93094f9bbfa30aa5051188ae50f2a85750d05cfb94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927954, "uuid": "01adc7a7-b6e3-4743-8010-857540139c44", "comment": "Malware payload (Gafgyt)", "value": "fc7bafce1fbace1cc1aebb31c7be636d2e8bd0cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927954, "uuid": "f3c55ac3-3f57-4596-8efe-7043090f718a", "comment": "Malware payload (Gafgyt)", "value": "dcd2375559f9233b581c8f941eeb2d3af74211b714c47f8041801b32586b977917d1288ce87d6b9e2a1c6057847b9c29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927954, "uuid": "01e83419-f040-48a0-8eab-bebbfb83e538", "value": "T198832AE4E012CD6CFB0B867A8977490D5914EA50DF934E37A99AACB368371F43D29CC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927954, "uuid": "f2368252-3e2a-4159-ac98-a9336429c7ec", "value": "1536:hw2hHXow+YkEtBl1xhv4zM/26qcYw8QqxXfUAk+uIuMZ:hw2hHYEbz4zM/26S/CA9huMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927954, "uuid": "58ecffed-c210-4ad1-b191-2e04f682c49f", "value": 85084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927954, "uuid": "e6d3e35d-53de-4b68-b5ce-7c365f21f21d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927954, "uuid": "47efd2f0-7d91-48c1-ae5a-a15d33a0bebb", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98fd1d7-da7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765888591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888591, "uuid": "bd5a1671-b9ba-4494-85b7-df2e53376e19", "comment": "Malware payload (Mirai)", "value": "15c0b5354bbd24ac756872f016d910a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888591, "uuid": "137fbcdb-9438-46be-aad6-ef3370af120e", "comment": "Malware payload (Mirai)", "value": "3c0e70fd79caad6093c631d263490ef313e04789ed7512f92bc59b8a7e4755d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888591, "uuid": "8c7fc3bc-7235-49c0-bce8-3f6382320e6e", "comment": "Malware payload (Mirai)", "value": "cf7ae16db39e2bd753049d72dc0c2f3317ec27aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888591, "uuid": "9206ed72-a129-48c2-b6c4-4abf2c8ae9fe", "comment": "Malware payload (Mirai)", "value": "51f905ad7c718b89875f6e6b7ba7a3945cf429b986416233f8fae9e8191309e13a6e724abfb5bf6922c44482bf077cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888591, "uuid": "95ce14d1-2905-428e-a7b0-c06fe389f134", "value": "T190E3B51E6E609F7DF2AC837487BB8B29DD5912923BE1C560E16CED005E7030D652FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888591, "uuid": "c37ed876-d6c9-4dad-be1f-0d92e8acf186", "value": "3072:bQbfRbjGpNDjtL1tH5Rdutb2x06A6Z5gbbMygKCxjVPJcTrkMaeiDfO6ncyAsKvl:b4fRbjGBIkbnl7U9mwELsE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888591, "uuid": "c48ed167-1b56-4819-b2cc-02a187ec210e", "value": 151380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888591, "uuid": "85cb6f8f-02f4-4e32-9eff-2c75f4dd3219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888591, "uuid": "6c78dfeb-5129-44eb-8e00-faa138bf03d4", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b987ae-dab6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765913729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913729, "uuid": "a900b71f-2cd6-402a-aecb-37c2798ddc45", "comment": "Malware payload (Mirai)", "value": "69ed7ff7ea860b3004ec5136b85460d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913729, "uuid": "a3d417ad-c820-4c73-91b4-7b7a587c6473", "comment": "Malware payload (Mirai)", "value": "3cf0464609cc819a50bae407b15b1314aed2925b6c5ba65a5ea830a786c341bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913729, "uuid": "1ee9f63e-4f4f-4ce0-8f55-9ccffc79270f", "comment": "Malware payload (Mirai)", "value": "7e9e5b48ac9648990a243dd1c776e3cd06464316", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913729, "uuid": "b34afada-e5c2-4632-b631-2b6927d0be9b", "comment": "Malware payload (Mirai)", "value": "3875b71f38d188a6b6b3949e482b3cf5090dc26a181521eca7514f48f2dc4bb413e59d86bd6e654b311a707822bf24ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913729, "uuid": "bcc7d72a-1d8e-4475-a02b-bdab7f1e9590", "value": "T10CB39E324015DDECD2944D366CA0453C8312A511B97F2EBA5AB9A8E7C48BDDBF0CE366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913729, "uuid": "3f22dc50-d3d2-4a77-b6e6-de6fbe85dc17", "value": "3072:tbHthGsP86CTH8S51JwMbNET8Um/Xl8WNzzCiXV:trqs6tZwMbqT8j/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765913729, "uuid": "761f795f-f7d3-47ac-8621-897348837b3f", "value": 111804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765913729, "uuid": "8d24182a-31d0-4e9a-b5b8-887d20d52f16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913729, "uuid": "acc1c449-770d-4b96-9c1c-722a77eec33c", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa32350d-da96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765900108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900108, "uuid": "da5d4dc9-5100-4bef-9d03-4fc1f6abf531", "comment": "Malware payload (Mirai)", "value": "01559c93e9d1b09b9d35e4ebebdaf44f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900108, "uuid": "f867ca2a-7e9a-4dfc-b1ce-c5a8e192e61c", "comment": "Malware payload (Mirai)", "value": "3d9bbe72f84736983e50e3248bbd14135a575a244a404c349508ac9e9bce0731", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900108, "uuid": "80b389cc-8111-4dcc-8310-29620f6ee5c9", "comment": "Malware payload (Mirai)", "value": "c8c57f23a5d0404a615a5484c4312345589f3ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900108, "uuid": "8d786d11-ed35-4dca-bae2-8b649a9ce2ec", "comment": "Malware payload (Mirai)", "value": "6461758327db77dac1f2566d21900d84ae94b481daffcc9b218e54ae7f362da3cd4c2e613161921bc7741ba339406ef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900108, "uuid": "c386bb9e-0090-4264-bbe1-f75221283db6", "value": "T15EC32A56BD41DA22C6D76A7BFF9E03ACB33613A4D3EE7107D8245B58738A0270E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900108, "uuid": "8ea3da75-4907-4b78-af0d-8bb3cc701196", "value": "1536:pF4+rGPTqSA26auNHJSVOJG217clizzrd8lGW9tMzFHhAsIehlyKdHvS8nTo5Z44:pF7K6hd17clSNfzFHhPpPBPS8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765900108, "uuid": "03cd35d4-8d04-40df-b432-d19bb48123ed", "value": 120464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765900108, "uuid": "e0fe0dc8-5275-4dda-b93e-b9de88b32118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900108, "uuid": "05655057-a41f-427d-a360-7b451b05435e", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee70824-dab7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765914316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914316, "uuid": "88456f7e-82b8-4039-9f28-16c322e3e3c6", "comment": "Malware payload (Mirai)", "value": "6804738b497ca7d37aab10b8f2ff9820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914316, "uuid": "823c9dc5-db74-44ba-a3dd-3b01bac77f1f", "comment": "Malware payload (Mirai)", "value": "3db6b24eb26a076e5702499332a5f22b085ba585dea15f1fc9bfd95998b6c854", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914316, "uuid": "939e8979-18e4-41ed-bc0a-1e937a6fe213", "comment": "Malware payload (Mirai)", "value": "8ca68946bc1619209bcbf248a278c633ff8326bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914316, "uuid": "6f994e99-db9c-4a23-b95d-0610d1e75701", "comment": "Malware payload (Mirai)", "value": "55dbd3f016675d2f59b2a9895f49c23de0e6244b8bde2239e8b412b0f8b1f1779984cdb96bde1ea9af306dccdfab66bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914316, "uuid": "57122ad7-33ba-4038-ab30-99c3e3cd54c0", "value": "T195B3F724ACC49B15D5E723BBFE5F118C33166F98E3EEB016D8102B65738A51B0F3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914316, "uuid": "334b6872-5dc6-4f3f-b11f-9c2e3dec0ec6", "value": "3072:sosW1w4K3JciAcB7D+xDVonKph+ZX5POVns5:9sWDQJciA+7SxDVonKpheXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914316, "uuid": "f6c84264-668d-406c-8d8a-58b99b1d6970", "value": 112820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914316, "uuid": "e66bb710-8415-4ee4-98df-7514b3acda97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914316, "uuid": "49f18526-4ba6-4985-9ecf-0c9201af659e", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0e724d-da72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765884404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884404, "uuid": "5dc34a14-468c-4f16-b3d5-0a8c2ea0a77a", "comment": "Malware payload (Mirai)", "value": "d0bff9d6a33c6b516fd312150887f33b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884404, "uuid": "25928a07-e368-497c-988b-078a6727fce0", "comment": "Malware payload (Mirai)", "value": "3de21fca923b53f5f10d8a5046e5c7548522572ec1f025ac83cd5b127c1e1628", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884404, "uuid": "f3bf44dd-e5d9-4f29-a3f8-5d6e33225f93", "comment": "Malware payload (Mirai)", "value": "331fcb6e3e62a259fe2b67c860eb26f5c19353ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884404, "uuid": "0437481a-e9cf-4bc1-95b0-640911c89f9b", "comment": "Malware payload (Mirai)", "value": "ef02cc70e4ea0f76a78763fc4c2ece4b0f118a4317e6f627062053348290084eb7cad1865657463425b547119d8179e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884404, "uuid": "a5526c13-3e54-4723-a4fa-31ab30388b5e", "value": "T163C3E7096F991FBBE857CC7785944B0918DC640732B937357A72E908FA0E25F0AE39B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884404, "uuid": "101e7d06-e9d4-46fd-9c77-be44442ef2b2", "value": "1536:GeIJzzr4nzcI5NWs2YFznhsl6F4q0rqlF8t6BvIwI8nF5:GeIJZIPW4Vhq6jrI8nF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765884404, "uuid": "c95753e1-e27e-4879-8586-6c8f90db2b82", "value": 122016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765884404, "uuid": "f474f37a-4d19-49c9-a24e-190070dc1322", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884404, "uuid": "2fac6a3f-e8bd-4c00-b6a5-dbd3d8ea67a3", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3797f1-da81-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765891223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891223, "uuid": "448b8d91-a4a4-466e-afd3-b2e42c3a7f75", "comment": "Malware payload (RemcosRAT)", "value": "396ea3a485c3eb417da2907f1df2b805", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891223, "uuid": "fb3e80e5-04d3-483d-9b14-a966a175b16d", "comment": "Malware payload (RemcosRAT)", "value": "3e04a1c4ff7dd49011493e23d5b9016c335ca927ec8abd3cc4b80ab0ff5948eb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891223, "uuid": "8f170a79-627c-46d1-b474-706a15f29949", "comment": "Malware payload (RemcosRAT)", "value": "47351ed011324ebfa71d3102cd230d0749dd9a44", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891223, "uuid": "635afbe4-aba8-4711-abfe-8e4d2ddc7500", "comment": "Malware payload (RemcosRAT)", "value": "5d15c1445c48089fdc5cd3e164219732cf6d1fc4866909720010be86cf8e1e3cd6e09034b86fe79a5a709c93052e6fd8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891223, "uuid": "bafa819d-88a0-4470-b522-9e9d47915bf0", "value": "T15915AD2A8D1D07CE26796A485A7E3E4D337095848C378F7A8370935B995C61E7E33CAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891223, "uuid": "9ba966b4-6fb3-4ffd-9ae6-58463f54752f", "value": "12288:meAbvjVS9xMXn6IIL+Vq6isG26wVZCcZjgaK8B88QsDi+1KZEPSGXvjKK/Q85xNO:mIT6PV6wfPRg8e83l1iEPBjKq1nG5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891223, "uuid": "a686afaa-16b3-4b7d-831e-85c25c5c81fe", "value": 884299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891223, "uuid": "035d98f3-1918-41b2-91ff-75c7c32027ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891223, "uuid": "04bb559a-672f-465d-8056-d90dd1ba349b", "value": "3e04a1c4ff7dd49011493e23d5b9016c335ca927ec8abd3cc4b80ab0ff5948eb.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e8e195-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765895802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895802, "uuid": "8ab1ca4d-a9d5-4627-bce7-a43c096c3180", "comment": "Malware payload (AgentTesla)", "value": "e1023eddbee992c0182c249590ef2fd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895802, "uuid": "4a372a4f-e387-4f7e-802f-13bff5f17cd8", "comment": "Malware payload (AgentTesla)", "value": "3e142a49ca8ae6cf9ce53be90b4cbc9d33b08484951448c264682eec89a87dae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895802, "uuid": "2015731c-b869-4366-be3d-5777f68a5ac3", "comment": "Malware payload (AgentTesla)", "value": "3e1fa9812b3fe19c590c91e9ff55d6068a5271a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895802, "uuid": "edd65d25-d9fc-446e-b53a-87e18b5b75a4", "comment": "Malware payload (AgentTesla)", "value": "c9461de8a3182105f8c38570b10d478393d47553fe2eb7e5b3d796f47ce321df6233875e9d9d4bc667520653ec0c8eb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895802, "uuid": "9a201fe5-138a-4959-b2b2-37ee577b4252", "value": "T110D334C437E2F861226732723A3B96ABE23D5C41718C48D9F1957C98F86C719F7B6488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895802, "uuid": "1c889637-ee0e-49bc-b8d3-ec1796a3b71e", "value": "3072:yCPz5ey5r2Q3I2zHr+fBfywPV3/nXfdvY:NPz5V6Q3Lapfz93/XS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895802, "uuid": "83826c9a-e731-4dc3-a67d-ba281e30f8d8", "value": 136491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895802, "uuid": "ea21cd46-67a4-4a51-8a4a-3395c8422009", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895802, "uuid": "25b6926b-cd60-48f6-9bb0-2f8b4b90759c", "value": "Past due Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216a6fc9-da84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765892147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892147, "uuid": "5c924470-b8a0-4c7a-a486-f0daa69300e1", "comment": "Malware payload (Mirai)", "value": "679f26659050b3760b50967e227378a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892147, "uuid": "71ce7860-0094-466d-a5b6-6402a16aa255", "comment": "Malware payload (Mirai)", "value": "3e44883e255c96907de8ee19f95cc8938eadd2ba376fa747ea2baa4d07b1c1a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892147, "uuid": "d9f37903-ac16-4261-b980-8ba7d8076d5d", "comment": "Malware payload (Mirai)", "value": "ec4cc54022f49d97a7a3eae9f2a81cc03cb5640a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892147, "uuid": "a0fe10f4-7f66-496f-89e0-07245fcfc397", "comment": "Malware payload (Mirai)", "value": "8930d5b4606e8d580a47b51160a250ce87e0ee13c726750601ada581b71ee1b6d9fa67c3854740e52ca99950954d5d4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892147, "uuid": "dfffb4d1-86fc-4bad-8e1f-fa1b862d6658", "value": "T13154C61E6E128F7DF3A9873447B78D309B6823D327E5D985E1ACD6105E1028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892147, "uuid": "93e4f669-3ca2-4736-aa89-f452e0028268", "value": "6144:JjWQN19IHsK9TghR2KyCfS3xJWLP+IjS5VOfDj2X9Cp1:bb0uagLPljSqPp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892147, "uuid": "5f1a0263-f8d6-418d-9d65-23e66a888b43", "value": 285380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892147, "uuid": "5d5bb18e-9414-4ad6-a612-60f55a35dfee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892147, "uuid": "a74b80ad-f26f-4b3d-b590-47bcb70085d0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435c37be-da85-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765892634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892634, "uuid": "99d42dc5-0bbc-4313-85bb-87caacc4095e", "comment": "Malware payload (Mirai)", "value": "631d0b512415f9f838fb432c52431f61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892634, "uuid": "fef71202-527b-4f1f-94eb-da8016900639", "comment": "Malware payload (Mirai)", "value": "3f27610e67efca2d12369cc19c68ba15f3a2103446f80f8a8152e4db1b0398b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892634, "uuid": "10d2025b-dab7-4f60-8954-9ba9954c8cfb", "comment": "Malware payload (Mirai)", "value": "6e79581c64133dabd2fe34f5e286a2c5d8db8767", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892634, "uuid": "5a3f2b8a-d946-4f87-ac15-7196277026fe", "comment": "Malware payload (Mirai)", "value": "c367dded8814e27a10f74676f2edb0d5d492c1e3881217be28790d1ee77afea57e10004681cf2f64b65acceac796631f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892634, "uuid": "ab3c5e11-c9fa-4c78-9025-25f21b1e1a65", "value": "T103B3F6407C419A16C6E76ABBFF5E529C33275398D3DE7107A8242B55B39B02E0F3E906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892634, "uuid": "d4ec4c55-1ad4-419b-862d-016c7d83fa9a", "value": "3072:hXlYqSglFkNl4zYfDMowCBipuO8n85Vo0:pl1ENmXowSipNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892634, "uuid": "0d3aa003-da58-4300-a131-81792cc2e564", "value": 112356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892634, "uuid": "68f7553c-4252-4709-9f41-77e5e4ff9e29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892634, "uuid": "6642e314-a2e9-4a57-9f05-08f7f066da18", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a724db66-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883352, "uuid": "3a375769-d2f2-4889-aa2d-6ffc6c364008", "comment": "Malware payload (Mirai)", "value": "a40f0d3697e9949921d94806e2c4f3f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883352, "uuid": "0e021675-6d5c-4323-830d-f66bb57ac679", "comment": "Malware payload (Mirai)", "value": "3f40469bcca831782dd2e5388f9a0c0543f40e2f66d9dfd4ff388436391c1da7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883352, "uuid": "f3bc532a-fde5-4a3b-a1ce-dd7d7ded6edf", "comment": "Malware payload (Mirai)", "value": "871e35787a424cd28138cbdef1c331c862698bb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883352, "uuid": "eabb5e1b-cdac-43a0-9f39-a187ce281c52", "comment": "Malware payload (Mirai)", "value": "6b9b019234bfcaf67cdb99afc67e7aef6f747c85e69c897454d51c6f5f3795cf0f014bfcfae5cb65ca102e107940c343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883352, "uuid": "ea287f1a-0f06-49aa-8248-01038635d315", "value": "T113E30745AD409F15C5D722BAFF6F118C331347A8D3EEB017E8286B55738AA1B0E3A947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883352, "uuid": "baf84c3a-7418-4c9d-8907-39ed5806a84b", "value": "3072:Ey9UmqOEHZM1HErC/sVtkg6odj1vkfxDQtUVnK65:Ey9vqOeZM1DEVtkg6odhvkfRQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883352, "uuid": "9ddb89e6-78fb-43c0-96a8-543d4fc19220", "value": 144172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883352, "uuid": "1917059f-ff28-4a4e-b280-1bc7eed82bbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883352, "uuid": "ea19a6d9-d323-4fc5-80d8-9cfacadcc16c", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e103e7c4-da12-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765843506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843506, "uuid": "0b160ed7-d654-4bbe-a879-04137507c7b4", "comment": "Malware payload (Mirai)", "value": "440e3f6cb555851ae3001ae1b9a0238a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843506, "uuid": "8846bc7e-566b-4e93-b9bc-a6a674656eea", "comment": "Malware payload (Mirai)", "value": "40cbc952b88460f4b3280e97deddd7ef1f6f035046a114b6807af6aaa654ec9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843506, "uuid": "f5fa634a-f529-478e-bfe2-4d1de8e26e0a", "comment": "Malware payload (Mirai)", "value": "e721ae107f49f644cf1f387f9becd50dcf5ee970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843506, "uuid": "39cef008-0e12-4dcc-a760-1ecdb6b45686", "comment": "Malware payload (Mirai)", "value": "04fc5eb03c66e6cf72dd6004c97034e2aafebdc9d26300f145a94518342603f7c7ef07c2b0fd9d0f352a15f66f1759af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843506, "uuid": "1ebad1c3-a7d4-49b3-88de-a79d64a11cbe", "value": "T1BDB339C5A000EDBDF40B96FA865F4F02A818E7506FC21F27BEA5FCD279630647859D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843506, "uuid": "ff7dd1ef-92fe-40db-97de-12a2f7cc6902", "value": "1536:OIw8pjDHOdPDKEJnI8Q94cGTH5PVSO+AICQz38un6N90FQ/IBiJPoIMwTPJ:dw8pHHrEnQ96ZtN+fCKFM0K/IBiZoIMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765843506, "uuid": "dde03e27-d102-4147-ac7f-819f2d7af286", "value": 111184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765843506, "uuid": "741c1f1a-bb73-40f0-9892-9d6cc831bd5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843506, "uuid": "202fb01e-4b86-4e72-b4c0-21d426392466", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426751ff-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895639, "uuid": "a161306d-3e5c-452e-813c-c7e9b428847e", "comment": "Malware payload", "value": "e9d516dc7a8ea947b7deebc8b8419474", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895639, "uuid": "f1db8aab-fc2e-483e-ac3a-2785799c2dbc", "comment": "Malware payload", "value": "411a839a7ed451f987b7b949e09e555cd061dd86967ba502adf1c32e651a809b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895639, "uuid": "af35de75-eea8-4cf6-bda9-466a5b8d497f", "comment": "Malware payload", "value": "617e7e8d2c8d79465ccad885eb79d684233019c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895639, "uuid": "afd50a5a-b6e6-46f3-bbf1-cbac4a836c80", "comment": "Malware payload", "value": "bdea4ed1c901b9ccb33ce01b95c59470ee6ae13d6515bb3c5e0a11ccd1143e70c96847372994d00955918b98f27495dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895639, "uuid": "4f1d2e70-c117-4119-92dd-7fdfcc60c190", "value": "T1E9625228383CD06FAD3D2D37AA25BA88E85C79BFB9F18D485024F97165D1C78A5303B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895639, "uuid": "7752ab85-9fd9-4162-96e1-09c33e0ae635", "value": "384:uALuIfmhNdvjylf6xiDK5EzKtk3Hz4iTem4KuKH4LnVR0QwZlx0F8UzCsEcGV/:uSfkX7ylf6xiDK5EzKtk3Hz4iTem4Ku+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895639, "uuid": "abc00244-fcc6-4314-9447-ab2dcf175042", "value": 15263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895639, "uuid": "74098cb9-24df-44dc-bc7d-f3c9693fb166", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895639, "uuid": "227c8cad-fdfd-42e8-b91c-e4ce4884847f", "value": "wtf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dc4f33-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879733, "uuid": "8c36a1ce-2378-4540-be97-b7bc51cb3746", "comment": "Malware payload (Rhadamanthys)", "value": "cb24fe6f27c281ee46dda77da1f49bf9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879733, "uuid": "aec89811-d021-4ef7-83a1-968f22d745ff", "comment": "Malware payload (Rhadamanthys)", "value": "412009276ce7f29c3e48194cb0ada0f1257b1796063309020d3a232ed724a141", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879733, "uuid": "3217cf8b-8fec-4850-b722-274cc19ef878", "comment": "Malware payload (Rhadamanthys)", "value": "c7cd24237535a375d71edb9ebe30bf920048069a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879733, "uuid": "1761a767-84af-4144-bcce-4e6f86be8019", "comment": "Malware payload (Rhadamanthys)", "value": "380ea383efc35bac41ad2ac9a542901db8dccdf994e582d0d4d9cc54b3c47aa4d09dd627bde144c522ec79453587230b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879733, "uuid": "025f3339-1c26-46ec-be5a-ba57b6f504e2", "value": "T1AA932CC96F33AD7A04973911ED9926FAA82C138089466189CC597352F1947BF7CAC3F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879733, "uuid": "eb6b4819-5503-4773-b63b-8c682f393e53", "value": "1536:GDB7eKg20hO9TVZAs3rc+IFw2qcg9FpkBaZBtI0OLtFr/pFaPIrUGEXiLj4bHWRn:GDB7b0hO9TVZAs3rc+IFw2qcg9FpkBaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879733, "uuid": "1fc01d60-06c1-4f73-9356-b024ca71fcd4", "value": 97489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879733, "uuid": "c5a410db-518c-4e40-92ac-785e5d24c79b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879733, "uuid": "878e1e0e-bb23-41ec-875b-e9e5a630a420", "value": "invoice-1637482117.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd21eedf-da82-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765891657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891657, "uuid": "092f82ad-3251-4a83-a079-b6eda573aba6", "comment": "Malware payload (Mirai)", "value": "f0b0f39320726d5623a6df496a814e78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891657, "uuid": "0d6cf63a-89ed-4ef5-b32a-06bf3bfe3b7b", "comment": "Malware payload (Mirai)", "value": "4177c1e4617753a8f27131ca27440dc4058fe017e608daa0ebd1968b5805813d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891657, "uuid": "069d1310-57eb-4151-9652-cb3696c319e1", "comment": "Malware payload (Mirai)", "value": "a2c95468475be476435997e644ddf53441ae03bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891657, "uuid": "1bcebcd8-0d72-4ff5-900a-d08e5da7e739", "comment": "Malware payload (Mirai)", "value": "8ea86400d884c7efc706691a286e195ea69c25b94c64c73a8fb637337c0a8b13d31073c2b71efe51f708e4511e498619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891657, "uuid": "57f4200c-e1ae-4195-98c4-6da13c18349e", "value": "T112B30955BE45AB20D9D2237AFF0B51EC37131398E3EEB2179C246B6677860270F39846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891657, "uuid": "8a7b7dd6-0b59-45b2-bc93-4e66028d8acd", "value": "3072:hdplosWtYxyfzSHRBvXILivb2t58U4WVnr5ra:hdpasWtYxIUBP6ivKty/WS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891657, "uuid": "612a98de-f05a-4294-9d6e-e96b9bf3c7f8", "value": 107856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891657, "uuid": "b5c26547-fa3e-40b9-91d3-bac34a8f74dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891657, "uuid": "948091dc-dd93-4f22-a6a4-d5dd31e3d0da", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9d9c2e-da1e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765848655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848655, "uuid": "9dc78331-26b8-447e-8312-e5ea30f4ce28", "comment": "Malware payload (Mirai)", "value": "afe71b916cd387c1568d987eb632399d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848655, "uuid": "28a2704d-b18e-4fb3-b5d7-fda34b2b6179", "comment": "Malware payload (Mirai)", "value": "4237dc80bc33b2d299e63a7b778d6b57cb661dd2448baaabd4b8e19f4e4a8061", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848655, "uuid": "6c3a9123-9ba4-4aa4-baa7-fe6c00f5367d", "comment": "Malware payload (Mirai)", "value": "fcb1e57bb1b68adf91a10997487f9f9b98cfe3f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848655, "uuid": "93e19453-a5dc-4b62-99f6-eb196cd13461", "comment": "Malware payload (Mirai)", "value": "89516fea8fd1848141b0d590ba808a8393888020ff325ee6738dbe9f40f47935a0ae2454ee96b5ae6223be5518455815", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848655, "uuid": "efe1bff2-7bbe-4cba-9098-180481220d2c", "value": "T111E3775D2F338FADF678873447B74A25976823D922E1D684D2ACC2105F2039E645FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848655, "uuid": "0436a910-156e-478a-b0db-8f374543659d", "value": "1536:Ik2h+5qw8mNnJ9Eo/DC9l0Wxgtcv6mU/tFlkT/daYezctz0reU5vI7psS:Pq+ImNz2/0Watcv6mu6ozctz0tI7p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765848655, "uuid": "f3b6455a-c7dd-4c82-878f-126c3f27d0f4", "value": 145664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765848655, "uuid": "d59e58ca-2617-4b3d-b51f-65e9edb89306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848655, "uuid": "589e8e8e-e8d8-44ba-9c85-8d19e6e7fdb0", "value": "nuklear.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b028e6-da50-11f0-a129-42010a9c0007", "comment": "Malware payload (XRed)", "timestamp": 1765870113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765870113, "uuid": "f5e4e6f5-339d-40f8-9365-f0479e39a6a8", "comment": "Malware payload (XRed)", "value": "517d2df59ad8a13c21f3e7ce2670ffad", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765870113, "uuid": "bb0ffc53-05fa-4cd1-a4a3-6d33be846506", "comment": "Malware payload (XRed)", "value": "42a7f86a6c0d42413f7a3b1a3f22a0f99bd716f40138f2cbd0dfaed38bc9ab46", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765870113, "uuid": "a339d52b-4a7e-47ac-8b07-094574a2c7c1", "comment": "Malware payload (XRed)", "value": "3f771f40664b59f7f8c8a34bbd7e123a3aa05e3a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765870113, "uuid": "1791d606-c3c6-41cc-90fa-ee60a849894a", "comment": "Malware payload (XRed)", "value": "29f5b2fcaadfd5225e17b080653fb2f8007e1beccd7c39e390ba3bc5301d793d4e51d2979f20fbdf2ced8b4a2e80a17e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765870113, "uuid": "7a72a733-322e-448f-abab-cd555eb7671f", "value": "T1434633BED7D5F948088E68D38E5E1016A5E605AED5323F3145E40A8BF2C7BCF2835DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765870113, "uuid": "13602768-6a89-43cb-8168-a3979833bedf", "value": "98304:ewmX2d24EgDrp8C4ngZMoqvPf8RrH/QGkJVc8Oi9eelS4rImcOwB:ewg2dKaROc8f8ZHKJm0l0Ucn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765870113, "uuid": "6810bb95-99b8-433f-9b07-e24fabb8232b", "value": 5369405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765870113, "uuid": "1d00468d-d558-4b66-a7a4-02ec6c675c41", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765870113, "uuid": "2a7a901d-fbec-42b2-8eda-9e1c0879445d", "value": "\u0628\u0644\u0627\u063a.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e50ae65-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879875, "uuid": "55efb2eb-9ec2-4d66-9a25-e0265c26bd7b", "comment": "Malware payload (Rhadamanthys)", "value": "3586e5191997d45ce450a5069a943ca0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879875, "uuid": "9f8ab91b-46c0-4ddd-91c9-cb29c90a8852", "comment": "Malware payload (Rhadamanthys)", "value": "432074a45e6d0f2cc8a016eaac0d84200bc34f46cab13bfbe49e3739ff6c849b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879875, "uuid": "671e792f-4f41-47c7-9814-2c0e2ba32cdf", "comment": "Malware payload (Rhadamanthys)", "value": "a3c63bc3a303a0302ab2414dc756f33354c2e4f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879875, "uuid": "954cb01b-4add-4bed-a226-80169307d5ac", "comment": "Malware payload (Rhadamanthys)", "value": "a425453f2620f95de78640ce40cab871643580a84317406e2b7833b11bde2677de7388558008a7ea57178bfbc29f92f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879875, "uuid": "ec0199c1-4e68-47ca-a883-37b04d538b7d", "value": "T18AA32A849E018CA105CF72811F7992F86926D851C494FFD6A09CF77322ACFDD7C5A2AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879875, "uuid": "b891e441-6c12-4394-b49e-8f8c10021c4f", "value": "768:GDhd0i7J4sYKgY/CMNfWdVY4lbdrXdlrVJDzAJHu3AkMALj0S1GiASLAuAAroQWK:GDB7eKg20frbrVJf/0AJox6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879875, "uuid": "13a41586-b66e-4437-855c-27fdd9e05449", "value": 100684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879875, "uuid": "842c4928-733f-4ea7-bae5-8b71959582d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879875, "uuid": "103dcd1a-6f57-4544-816e-d825a43a220f", "value": "invoice-1637482117.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57635008-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879783, "uuid": "8f913612-b1cf-4752-bfdb-2b5e7bf680f5", "comment": "Malware payload (Rhadamanthys)", "value": "a1115f959cebf9be35cf68eaf2cfe890", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879783, "uuid": "cdafa1da-51df-494a-8bba-029431e08c27", "comment": "Malware payload (Rhadamanthys)", "value": "432dc964949079f4bfb1eede9b4d6c488e97acbd22b2f04fb513be0edd09bb9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879783, "uuid": "fc6d6e74-26ad-4637-aab7-460d0e54b4d7", "comment": "Malware payload (Rhadamanthys)", "value": "f04798c27950163ce40024618a794fc6d53a8270", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879783, "uuid": "5c1f293b-652d-48bb-a9bd-db7e479b7751", "comment": "Malware payload (Rhadamanthys)", "value": "cb8234ea471c53bb46cc12993c90484242b658582cfd0c5c81a7253de0c238a5dc99cc1d9995c00b0375270319b3b5f6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879783, "uuid": "06ea07e7-fc7d-467e-961a-ad17c8b0b561", "value": "T15FA3F9F8891DE8F51F83D5446BE844E6E975D2F6AD4A32A83E0EF334942577809242CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879783, "uuid": "421e10a0-c333-43e8-b14a-2a91376b04fa", "value": "1536:GDB7eKg20YoqhXcuXoz32BmzEBx7YuC1Yctb0fQQTQhqHVEEjUEjHpY065Pkrabt:GDB7b0XGPz+64a6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879783, "uuid": "4955d1a1-dc67-4740-ab7e-bc13f98a55f2", "value": 102698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879783, "uuid": "2c16157e-0cc4-44cd-9c58-dfca2b186874", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879783, "uuid": "5d6180d9-a5d5-4b15-a18d-28c8769083c4", "value": "invoice-1637482117.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51fc3d2-da1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765848211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848211, "uuid": "c010d2b1-5b5e-4ab0-9591-8121ef9ee9b7", "comment": "Malware payload (Mirai)", "value": "41ba0900efecda0a2224be414bd4b152", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848211, "uuid": "a638568c-c4e0-4b68-80a7-ba79d69ea0ff", "comment": "Malware payload (Mirai)", "value": "4337b107f0fe419cf26315573297b7ca088d67a923adc36089be13d7ac5d840f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848211, "uuid": "84c9e844-0e45-44fe-b5aa-599404f6acbd", "comment": "Malware payload (Mirai)", "value": "3c68c40199abdf4c6216a5713b14b1049fef7225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848211, "uuid": "9f34e43e-7431-49d4-9bee-5d7c7c8d0449", "comment": "Malware payload (Mirai)", "value": "28feeb29e9829c369d8a1823388f9e23eb36ff7d20f27aecfc72c4db59dfbbdecec164cbcbc73ef15ec7d03dceddaf02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848211, "uuid": "6a9a30cb-7e56-4f46-bccc-9d09ea5a2dae", "value": "T16C933C47E7808F03C0D61775BADF82163323DB5497DB63065A28AFF43B867AA4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848211, "uuid": "2eab6d66-63b0-48d6-9d5e-0ce21d823618", "value": "1536:9cnyaxyr4N71CeK+xniSyT2ul1DbiQEDjb9df4ij6yrzw/9/3WoZIf9:2keK+xnidhEDjDftjrM/9/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765848211, "uuid": "498842ca-8b63-4b28-b22f-71a69061861d", "value": 94020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765848211, "uuid": "fd25d7e3-74f3-49d3-a4bf-aa75f5d15003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848211, "uuid": "9d461a31-dd2f-4ff8-b603-d35d3900a942", "value": "nuklear.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f153b99-da2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1765855744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855744, "uuid": "63796e18-7dce-4e3c-887f-c884f8ce7931", "comment": "Malware payload (Joker)", "value": "d36734c0c72602a64d21029915edd73b", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855744, "uuid": "4a40bd07-74e2-4f3d-8c20-00571d8ebd68", "comment": "Malware payload (Joker)", "value": "4354318cd92538cc3d4db556f779c757ecb5ba1f9eb765992b247622bb12c4c2", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855744, "uuid": "5599ee10-d3df-48ee-ac07-f983c8b72c89", "comment": "Malware payload (Joker)", "value": "feb7077d1a49439514d2aa297e9292c88cd3e37b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855744, "uuid": "03ff7b50-e931-4b5d-be21-6c5ecb8d0922", "comment": "Malware payload (Joker)", "value": "60db7e9162a5c415a55e4fc80f8907a8f582474c9e6c402afc6de06c12f4bbe710279200bd32a44488aedbd95e3172d8", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855744, "uuid": "e117c6ae-f47d-429f-bcac-121835359080", "value": "T12C67E188E19EEA41E4A7F1BE9F5A4163B2137D844131D1EA1C16768CBDF7ED0CB2B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855744, "uuid": "a75e9f0d-3dd8-4134-87c0-7d907d92b4dd", "value": "393216:3PLgXiztxkNkqbgBemPdzY63oXj4EsgE8NmY8tMZq5pQDLvbCPxId:fLhzcNkHeYzbdEsgE8sY8CZq5pQDiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765855744, "uuid": "5bce5b47-53ce-4029-8278-7b4815a25b03", "value": 30371092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765855744, "uuid": "a1702cd7-de2d-4d3f-86c5-0e3683e76352", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855744, "uuid": "29df559c-4e66-42ed-a234-81f60a78257a", "value": "Easy+Storage+Cleaner_1.4.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db08676-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873861, "uuid": "0726a73f-1677-404c-99d3-5305bb25034d", "comment": "Malware payload (Mirai)", "value": "c518a63c6dea05fe8f8cc51052912f9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873861, "uuid": "0a572543-c203-4452-a66e-1b8de6a0d4b0", "comment": "Malware payload (Mirai)", "value": "43a0ccc5cb6f3d41feea918ddf2f29a4d0a87d0117c6ea00476d848873c3856b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873861, "uuid": "f440bf07-a6f7-4149-bb56-0bd08a999133", "comment": "Malware payload (Mirai)", "value": "828bdf477f65eda875fb4a2c7a539ebe93c973a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873861, "uuid": "bd8b8705-f26a-4aa2-9880-39e125d67559", "comment": "Malware payload (Mirai)", "value": "ee186cabee9fcea3c094f869636d8e392ff57dd89018b707010d25719fd7003dee856df998f75f004c3e681f359ef65e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873861, "uuid": "49335da5-abca-45bd-afa4-7067e5a46e7f", "value": "T12B230894B9819A16CAD0537BFE0E42CD3726A398E2DE3313DD225F6137CB92B0DA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873861, "uuid": "a5532562-4380-4ddd-b6c6-305194d390c3", "value": "768:4EeKUK5RoV7uJOSQpcwYk0ai2sdjBfEXYgKodZ+uByrl5YZTbcykb+7ulBeHEczX:VfdoOQ5H0osddgFdZ+uBkluOxb+ylB4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873861, "uuid": "eb32b8e3-6416-4b56-a262-adf8d1ed2095", "value": 47968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873861, "uuid": "23cbce92-b262-4809-8bf0-512eee583f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873861, "uuid": "f47d6937-c11c-4b0e-9a70-345babd510b7", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b2f142-da19-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765846440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846440, "uuid": "e77cba22-0472-4221-8656-b38f28407f21", "comment": "Malware payload", "value": "cab715de689e2cad0843ca538ba67d33", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846440, "uuid": "f7ff0062-67a1-4411-b5f7-1f0ff5c2612d", "comment": "Malware payload", "value": "43b63f7ecdf8fc8f25fe1ebb961596446f23f79752da4a1c0d7242ccd61dc73f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846440, "uuid": "82d0270f-f54f-41b8-8096-1e054bfe998d", "comment": "Malware payload", "value": "8b1c7fa7afd245adcccb8d5c355e013aba3c1256", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846440, "uuid": "f680773c-8f10-4c3a-9129-0ea3650a1b72", "comment": "Malware payload", "value": "750249c8c990bd73593e1daead92962a852ac58a06a21753bb713a483033e109db1090ae0965b513e0495642541858cc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846440, "uuid": "d7c694d8-823e-4a30-9523-4583cbf521e0", "value": "T113E5331273E54670D0C6273B1196BB1366BBF6710B3842D366D4AD16AC31BE27F386CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846440, "uuid": "2d2069e8-4df5-4f49-bbf5-8ff3e32e08d2", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846440, "uuid": "10f67eaf-7c44-47e6-8e29-c32a7f761e83", "value": "49152:2j5LshU7fNq6BnpUEmsotByG0x2KM3U6y7eYNqGnovgoW/Gr5Pdv9e3Ns7Lu7z8Q:2j5LoU7lbnpUWoS1nW+N1KWOrbEW3Giu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846440, "uuid": "9ada4074-8d85-48be-976e-2da8e9c37d49", "value": 3050528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846440, "uuid": "89adcde0-9382-414a-9c05-54590d83d1b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846440, "uuid": "2eb361d4-d290-404a-b73c-73d6f9711ea9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf3a240-dac2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765918957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765918957, "uuid": "6a1aef8c-2b3d-46d7-8922-13fa1393eb01", "comment": "Malware payload (Mirai)", "value": "86cc9c6d9ce672aaaf124de6dd016ab4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765918957, "uuid": "7aecd76a-1593-402b-8e78-e37ea2f0db8d", "comment": "Malware payload (Mirai)", "value": "43c37656f225f210694840765598d0525b4e069390449d6390e2362490d88ab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765918957, "uuid": "50cbba41-eabe-4027-8f70-7c9a312bcf45", "comment": "Malware payload (Mirai)", "value": "e7d416f036d1d19af00541e2bc05fc4d0fe48cdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765918957, "uuid": "aafdce30-1766-4e50-827b-2ce26cdb70c5", "comment": "Malware payload (Mirai)", "value": "d96d6cdd295038c8a7582ff98b54181c2b9e45be465d7998c302d60e11c69da52abffa584dee3819107d28d05e6b74b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765918957, "uuid": "d7db780d-b52d-4ffd-b500-23d4a021fd78", "value": "T1F8C36C36FC74BE27C0D064BA51D38232F2B55B0811E9C739BC724D9CDE39928265B6B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765918957, "uuid": "0daeb155-6845-41f7-95d6-83fb234694fb", "value": "1536:HvZS1rO+mcIe02+3FfFDVW87x5MqrSVrz/XKPmthFrVzrbOzWaXZMSIwQSZG8j3B:PgXhIe6BOqmlrNr2GS5rj3tBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765918957, "uuid": "92abfe5e-bfd3-495d-86c5-db6fd5bcf815", "value": 120580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765918957, "uuid": "3273c43c-4057-4942-942a-0582394b7d3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765918957, "uuid": "1fc08b12-ff5e-4cfe-9f3c-109251166d9a", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228ae97c-daa5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906323, "uuid": "ab62b2ce-a65e-4fd0-aedc-07cf6a9a50df", "comment": "Malware payload (Mirai)", "value": "cf37671d4878197ae85be67fe1ac94ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906323, "uuid": "1f8c4f85-5bac-45ee-9168-f37600278867", "comment": "Malware payload (Mirai)", "value": "43daaacd4b295a62862428ae7417bd4b384fe490719905cade9bb8dcd8886fb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906323, "uuid": "f7e8441c-c4ec-435c-9434-ca0897b611f1", "comment": "Malware payload (Mirai)", "value": "d564ebdf3be10de969b647d037056b71a27b497f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906323, "uuid": "77247be2-4f47-422b-abb6-0342cf3e5d70", "comment": "Malware payload (Mirai)", "value": "5d6803c411fbd32baab89c88b93ad7c817e183c2e2a01cd1930592ef998b67f9a4fc89f360a79b3c09481ce5028dcf84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906323, "uuid": "82688a89-4697-4755-9403-5f5a06ef45fc", "value": "T1BDE3C60F6E219F7EF2AC537897B34B34D95926912AF1C5A4D1ACE9006DB030C686FF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906323, "uuid": "9e604937-f978-4bda-b393-dafd191621a7", "value": "3072:JdSEGIbDpzhHGUNByAf7GHmj79aEWeftxzCHVCfKHilvZ0t1MXkOV8ZboyFOW8VM:XVGIbD+vuWFgxophj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906323, "uuid": "dc02dcdf-7550-4da1-a0a7-2293ea31d0a9", "value": 155732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906323, "uuid": "ccbc296a-58ad-4da3-a94b-47e2cbf03983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906323, "uuid": "32a267ea-cebb-49a9-9c0e-a5491a69f9d9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d9772b-dac7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765921174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921174, "uuid": "bf07e79d-3ff9-4f04-9b24-ff20eb457c1d", "comment": "Malware payload", "value": "e365cd4eecdb18128d8f9135c7cea36a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921174, "uuid": "c66c05bc-cecd-4be1-a26f-475dfe9ee380", "comment": "Malware payload", "value": "43dd259ffdef20ab4042f42d628c14eb1c299f0e52c5e8eb9822d36690bfbb48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921174, "uuid": "ad5fe84a-2394-40c3-be70-21e13174b264", "comment": "Malware payload", "value": "0d0e4c750346729ff655ad4ebb6638dfa04ed028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921174, "uuid": "c119cb17-18cd-4692-85b1-c95374dad584", "comment": "Malware payload", "value": "f14817ca3bff5a1a19713489825393bced4e7b80f3dd01b4466884ea5834101a76db5a9bbf6c9dd931ba130276d6f4b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921174, "uuid": "ce50a8ea-5c60-40e6-9ec0-336f09f03a0d", "value": "T128B66ED29D600676D5ABF235E9A252853330B844533220D7BA952BA94D77FC4233BF2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921174, "uuid": "4307f185-7df8-4d4d-a477-04058db24489", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921174, "uuid": "0fdcfd7d-4bc7-4a8c-95df-4fc7c4bf3734", "value": "49152:Z0UtMYoxVwhlxrKniRAVcnscmGQ3KvN15Sa4jh1TlaMgGcoDV2t//LORJJJO+ZhL:Z0JVuNx8w//LCJJ8c/mFIvtCIzu9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765921174, "uuid": "7f8f5d68-eda1-40fb-8bc5-e21131c5b903", "value": 11374776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765921174, "uuid": "46a5fd21-7a6b-4181-ae79-30ae62be5c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921174, "uuid": "c1aa0742-fd8e-451b-b638-0569b81547e0", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107aa539-dad6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927338, "uuid": "e7cd68a0-8e4f-41a5-9d8c-c331ff0177da", "comment": "Malware payload (Mirai)", "value": "3ffea5b8133a8790c7b10a1e4659db63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927338, "uuid": "a491dbf2-3841-4f2e-b7a3-9cdf062a708f", "comment": "Malware payload (Mirai)", "value": "4472ba8a60a544f184a8bb745acc7515e9662652ca00defd0fa3329e2818a43a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927338, "uuid": "922b916a-6999-468e-ba4f-0723648ba036", "comment": "Malware payload (Mirai)", "value": "166ac57c952830526cec3eeb63b3288d7f289342", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927338, "uuid": "d57954f6-e6e8-4686-a1ef-58e0b398ce6a", "comment": "Malware payload (Mirai)", "value": "12ca6e55c0c91c9c98bff0aab05b3dc56235a4d789f489c85919c5b058d100681cb3fd18d98e866cbc045f0c3d897dd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927338, "uuid": "8476a337-3a6e-4aab-902f-87ea669b9147", "value": "T1F1A3F95D6E178FBDFAAC833547B7DD11D248338627E1E245E0ACD500AE7028E685FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927338, "uuid": "2cc9c3d6-394f-4aa3-b490-86577b98b854", "value": "3072:uQIjAz6zVml8sV8v8xKkIPvK48+cmDOdyEq7JwZoPP:uQIjAz6zVjsVU88ksyQDOdC6Zon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927338, "uuid": "f7fe0711-2e2a-451c-bcaa-34a61aeac803", "value": 105520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927338, "uuid": "35e44d78-9d7a-4917-90e6-e4843a786879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927338, "uuid": "c2499b34-f60e-4ba2-afd5-879bcd92092e", "value": "shadow.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305212bd-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879717, "uuid": "bc7ff5b3-a12d-4685-9b48-945f30e27048", "comment": "Malware payload (Rhadamanthys)", "value": "13cee8f22bf17c7a578b12483dc07edc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879717, "uuid": "c6a7f723-b1cd-471b-a286-69eda3ee9202", "comment": "Malware payload (Rhadamanthys)", "value": "44bf22b6e213c977e4d7a8c08983be957d7b4f7ca39a565e11c657b80ec3f158", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879717, "uuid": "5644f28d-c696-4b3e-b364-3277ae02ccb7", "comment": "Malware payload (Rhadamanthys)", "value": "0a3e73c4525090dd178f3f670319a8c14771500a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879717, "uuid": "01d55fc1-c4c3-4932-8e4f-7e65cf43edc3", "comment": "Malware payload (Rhadamanthys)", "value": "4343c4dfa770dc24f3d8e3847d3cbf559da4098a82b14f8606dba7aec70fbb2cc7f53a58de362c355628ed683cac3f45", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879717, "uuid": "8c767d2d-d4a4-49e2-9881-4c6505e907a6", "value": "T1E2A31A0AAFBAECAA24D2E4CB0D64C7F1C0474827F9F199A61E5FF67A05F47E00851C91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879717, "uuid": "1438bfbf-ab2f-4aab-b24c-f2312aa08e8a", "value": "1536:GDB7eKg20t7YrbrG4oAU6tmsJAg/SXVc6BkQWJ+aY:GDB7b0t7qnXo/6tmsB/SXVc6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879717, "uuid": "6003f3a5-804f-4e90-9fde-90a58fa119c8", "value": 103378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879717, "uuid": "db2e413f-0ed3-42f5-a86f-544b6036d145", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879717, "uuid": "8e0977ed-1003-4260-b505-a54228da61f3", "value": "invoice-1637482117.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb973a8-da97-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765900354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900354, "uuid": "f2f97de4-e07a-4706-96dc-a236d96d3a2d", "comment": "Malware payload (Gafgyt)", "value": "4b483bfae7a68435352f4020774582c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900354, "uuid": "5b8faa99-e9df-4a46-8e22-5e49c66f9ea3", "comment": "Malware payload (Gafgyt)", "value": "44e365fe95ad0c45ffd254d44e67de6022eb751aa0db064616452b7c2eec0d6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900354, "uuid": "aeed1b09-aa1e-4a16-8e0b-29cfaf848182", "comment": "Malware payload (Gafgyt)", "value": "0c3a167ecb0017827a8e3ee95b4842c1b740a0f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900354, "uuid": "8e4381f0-bee8-4cb6-a3c1-2d56a8914f05", "comment": "Malware payload (Gafgyt)", "value": "024d81ed11116e404574d2f8286e4daec9a8eba27b115e207a1ea43ba205d6040679e027a9f23143a86e057db9314f51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900354, "uuid": "0afd78ac-db0c-4618-84b9-a8279d6b73c7", "value": "T1C8833BA06021CDEDED1F867AC6A60419AE35E2411F520F37D496FDA7DD221A4F83ACD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900354, "uuid": "2da7db8e-1d8e-45eb-a64c-8157fffe1e20", "value": "1536:goJq8DYaKXAEt1CVJYBGT0zwDPP8uXZd/mEfmPDMGwVy:DJq8DYmENYww7JXmI6DMGwVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765900354, "uuid": "23433b4d-c75a-4365-8a72-233c5f18ba51", "value": 84504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765900354, "uuid": "c284de64-c98f-4358-b1e6-18e397b26695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900354, "uuid": "2a8c065d-f936-4b92-94e3-5ee29d0f3e9e", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d957d7c3-da55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765872270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765872270, "uuid": "c11713c1-ab4c-4467-86e2-ca065004f5d2", "comment": "Malware payload", "value": "a6c47e6686ed7c39186bf1ac282d6991", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765872270, "uuid": "0e09c9d3-949e-414b-99d8-9b917c5d8a6d", "comment": "Malware payload", "value": "44fc9e306763774b50b61fc7487aa1d219aa288aefa201119c7bc278e17600a8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765872270, "uuid": "acfe0281-1e3f-46f3-b722-7dc284e6b03d", "comment": "Malware payload", "value": "126c9a157ece6a8e1f65b241eae1bcf218510c4e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765872270, "uuid": "7baaec9e-0fe1-4b56-bdee-d193fb480739", "comment": "Malware payload", "value": "9e9912abab1264ada7ac17d55f79676925b23a7fc035b30725e8bfdd22092eea16a3176eefdffaae52cb4364d1e67dc0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765872270, "uuid": "ade9f134-242e-44d0-8c0e-eff020117d2b", "value": "T18A96331193A2F0E3DF84077A39B3BB709D5F1944F1BDA0206B5A27BFD5963C48269E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765872270, "uuid": "71e3968a-dcca-48c0-bb1d-a37dc9601f4e", "value": "196608:TvlW3umvlW3u4vlW3unvlW3uDvlW3uBvlW3uTvlW3u6vlW3uRvlW3uBvlW3uj:TvI3BvI3PvI3svI3MvI3uvI34vI3NvIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765872270, "uuid": "e38231c6-5584-458a-858b-d2dd2b244bca", "value": 8762595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765872270, "uuid": "7484230b-2677-482e-b3e0-01286d1c1029", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765872270, "uuid": "5d34cf4b-efad-4b5b-b2a6-5a75ee30104e", "value": "4_5886570468093206183 (1).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06f2bca-da6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Redosdru)", "timestamp": 1765881677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881677, "uuid": "7b3deb2c-4ce7-4f7d-a7b7-5028bb220673", "comment": "Malware payload (Redosdru)", "value": "99ce3c1fee01cb8d50af2721b943a303", "object_relation": "md5", "Tag": [ { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881677, "uuid": "d27bcbc3-535c-455d-91ce-69065df4b8a9", "comment": "Malware payload (Redosdru)", "value": "4519056d3bf4ef2ab746614645fca0db223507278fca02b0015b0af44d45e6ab", "object_relation": "sha256", "Tag": [ { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881677, "uuid": "933a6a66-6fbf-4590-bb1d-9f09d2094e4f", "comment": "Malware payload (Redosdru)", "value": "f63459cb9d54c0f3bad50a6b19dfe6fba3a9740d", "object_relation": "sha1", "Tag": [ { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881677, "uuid": "e8c30dcc-4de9-452f-a425-57958443716e", "comment": "Malware payload (Redosdru)", "value": "db3b4042f57eb98a600936349fe7043076043eb5980fec2bfe32d8d14ecc29d794458de92f5a260fc4e222ce046d13be", "object_relation": "sha3-384", "Tag": [ { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881677, "uuid": "fd71f8da-c7ed-46ed-8dcb-8fdad1fe99ef", "value": "T158051232F6C084F1C5B208398AE997606B7DBD301F148A6BD7A82E2D5E345D197287F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881677, "uuid": "dfb2b3a5-537c-47cc-ab04-73ce5bb659be", "value": "73d12a96fab08773e2657237992c3c27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881677, "uuid": "d0c0149e-b5fe-4ab0-a1aa-9a00d5c43d20", "value": "24576:dE7Xaq+zQN658FE0ckFq5+BJokGGE4+bSCvAo3+lK:JS/q5+BJokFE7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881677, "uuid": "294e1c71-7170-44bc-bd00-2af17fefc675", "value": 840913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881677, "uuid": "67571985-971e-47ab-b1b2-73b08326b304", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881677, "uuid": "0ae07c64-48ed-4a16-86bb-82855d3079d3", "value": "103.204.79.115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a827c76b-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879918, "uuid": "59a6a6d3-f241-41e6-bfe9-1ec0a8916447", "comment": "Malware payload (Rhadamanthys)", "value": "913f8e0b699044e65e39ef975ebcadce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879918, "uuid": "ab89a52e-b81f-46b1-ae1f-2ee2fde87a2a", "comment": "Malware payload (Rhadamanthys)", "value": "45d5310d79fd9b90af1953d51eb78286fe49ed5b99919a82d197fb97bca2e0d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879918, "uuid": "ef4999a9-6e70-4300-aa62-a9582f5a279b", "comment": "Malware payload (Rhadamanthys)", "value": "9a17da40ac723e705f57fcccf23fdb0774125a1f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879918, "uuid": "fed59bd6-5e66-4eb6-988a-02c64862cf88", "comment": "Malware payload (Rhadamanthys)", "value": "751ff2f7d3ef01f40decb40d52398db542c7c69bb04def1416dbc69f2ed21bf6d9894867af0da67990837342f4e17727", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879918, "uuid": "78f58763-193c-4638-bc66-176d5993c31d", "value": "T103A329069653E57D18C6E2E577C818BDC4A9E9D2162DF0866C1FDBC2F88897608D0BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879918, "uuid": "c462c392-ee07-4204-9908-77ffaa6121e9", "value": "3072:GDB7b0vS1QwPbscLIvshaHKhRErw11xKfEZLmZLH7GbNdmIjMRdv38GkqIbcG3ZY:0UneqBWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879918, "uuid": "560bc4e0-1d0c-4c72-9f1f-3de660bcd543", "value": 102048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879918, "uuid": "f356530a-ac94-4770-84ef-2f9b20787f9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879918, "uuid": "5efb9e26-7eac-4c63-b11d-23fa9ab0ccc2", "value": "invoice-1637482117.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce3fdfd-da6c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765881805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881805, "uuid": "edb74cae-e13f-4344-bfeb-dbe5e2b79250", "comment": "Malware payload", "value": "9faff3dc1685574910d73847bf3be444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881805, "uuid": "44c2ce99-c39a-4447-8eb8-888858522e7c", "comment": "Malware payload", "value": "47095fd9524a17bc79a92a3346a7a2a3e63c3b03ff94a841f56f4cb7bed63e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881805, "uuid": "8e67bd25-b231-48b4-a5ad-1af70159c5fe", "comment": "Malware payload", "value": "43f17eb7d1da559f4663fdaf661afd2809235d85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881805, "uuid": "73cbec46-b0f3-4030-bcb2-ebddd545debf", "comment": "Malware payload", "value": "49c35c26f6378ee273219702d6d8a9386746c32465da07494a303d4d8c28500841308c4747a012cdc9d1e6d0500d6827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881805, "uuid": "9b17afe6-275b-4e94-86cf-c2ca55592210", "value": "T10B86337676E0C476E8660031E6953B01AABDFB7526AE31C3FBF50E14734A14B02277A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881805, "uuid": "f1179348-d514-4f44-8a1f-0995849e8641", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881805, "uuid": "8d4e1afb-b542-4b15-98d7-4a5ac874e0f6", "value": "98304:YKznxSZnAbkFB91WScfzv18OznS10v0vVYPThmfpA2pzAfe7A65c5d7jq8txqQ+G:YoxGnAbyWuXq0tYgpAcyvucvK8P+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881805, "uuid": "d91677c1-6e7a-4537-9be0-deab79ad634c", "value": 8308726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881805, "uuid": "8ce9fdb9-db7e-48ed-9f80-c988f478c312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881805, "uuid": "452a385a-288f-4670-affd-0df74c4b35ad", "value": "ftp.ywxww_1.net", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb931e7-dad6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927337, "uuid": "580899ac-6f25-46e2-9e6c-075d66c3bb9a", "comment": "Malware payload (Mirai)", "value": "89bc20b77988db547e49293bfebfe2ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927337, "uuid": "46fc7ab5-478a-4807-ac08-fe7d7ee18d03", "comment": "Malware payload (Mirai)", "value": "479bf8edc5c04cf23d5721b7bbb4a31830a557d37546ae5440a711217e7337c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927337, "uuid": "1d3b5dd6-dc9f-4c05-ae57-e23b8294b8c8", "comment": "Malware payload (Mirai)", "value": "df43446ba672ad2c1a6e3e47606e48daa5b9562f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927337, "uuid": "918d1882-5ffc-417a-b56e-12e87b92d7f4", "comment": "Malware payload (Mirai)", "value": "0cf97932a86e1611ba4a1c8ed613f9fed3d8b5614f6b9a157a453c6dde20dfa344c5557f274309d5b9f4b6ae87cbc7cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927337, "uuid": "3df3e0ad-9458-49dc-b30d-d22490ac139c", "value": "T14BC33901BE418B22D6C7727BFF9E439C332A6BD4D3DE7607A8606B54738A4270D7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927337, "uuid": "5987672c-20b4-47fc-91aa-9b526437226a", "value": "3072:zoTXoIik1+WGl1gaY4CTfIdXBO0pIJgbVkMUm8nX25:zo0YAHIJ8X5IJgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927337, "uuid": "8c198e55-f501-44de-a71f-051c56b9f262", "value": 121212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927337, "uuid": "cec1c360-18c6-4205-b24a-17f88d3b97fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927337, "uuid": "69abd3db-47f2-44aa-b6d0-c0da1875f062", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3651a13e-da53-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765871137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871137, "uuid": "1b5549ac-9c0a-45d4-aa13-6ba23e631440", "comment": "Malware payload", "value": "0029a234768d4486f0389bc66223b90f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871137, "uuid": "8dd06202-8e06-4eaf-ae7f-dc854d7b9217", "comment": "Malware payload", "value": "47b9ce3bdeae7951ed43ae5619d1d3343edf569fe09c18c3a8e5bade05ec416d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871137, "uuid": "38ebd086-826e-4e15-9912-15922b4415ca", "comment": "Malware payload", "value": "c6d236b0d8452e4cf80b716d28a184fd613cc0fa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871137, "uuid": "4f631ad2-e7ad-4a83-8522-a74dc268fc22", "comment": "Malware payload", "value": "74ec0d89c6aa4ce8d1c33799d14f1a27bc20122a29990beb945fd73c36e7f60f1c15c2aa6a555d622f0e21b3817ab85b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871137, "uuid": "00e38c40-2750-4a16-9196-d892e8a3ddc2", "value": "T1A6C733E025CC1618C2BB7839C91DDFEE4A0A451BF8918FCB6425938570CEBEE5E6494F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871137, "uuid": "b8990dbc-041a-48ef-babb-ee9cb33f0e88", "value": "1572864:PciqVfZ5fZFHQCRsRduDgK7GtnswtC/qsOjcXODAwGTc:PIF3rudv8TwtCitSODAxTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765871137, "uuid": "05490aa1-8328-4857-afec-46f6a929d9ee", "value": 54416950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765871137, "uuid": "7df7208a-b00d-4e12-9265-0756101bc388", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871137, "uuid": "55f18480-6a6b-4f91-8107-e87b1d27ede1", "value": "MitsubishiM700-K6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3c67d9-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1765896377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896377, "uuid": "abe20f74-b269-4605-9925-d4c62327417c", "comment": "Malware payload (DarkCloud)", "value": "ad6917d9bc6f7ad55e076a69f83cfd7e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896377, "uuid": "1a3c2900-4ecb-497a-8ef7-8bc057f2923a", "comment": "Malware payload (DarkCloud)", "value": "47c38c735d10a59275baf8e004312498f5c840d656a4ea5d32ea22fcac2844fb", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896377, "uuid": "30139a56-d894-4ec6-b56f-446182836f39", "comment": "Malware payload (DarkCloud)", "value": "0b219169b4f45fec40d63f077d87e5f637d364ae", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896377, "uuid": "f8380709-97a6-4855-bfcc-6d9f4571c631", "comment": "Malware payload (DarkCloud)", "value": "61a4c48927abe2c6b21b17ab14796116cf5e6930cc791c78aa8059cfcd1738ee4b7f6ec70b8837ac4748b0dd6369a77e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896377, "uuid": "a689632a-a793-4a6d-aa69-5ebe6fe35d28", "value": "T1A3359E21A7845B8A3BCC498BE07C1B4F73F36B5AD56270CC57832A07742FE5E9938895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896377, "uuid": "6ae74b91-c5dc-4a4b-8879-0d81b4a29ccb", "value": "12288:XHE6z/m42GTdP99mZLHcoWHJ3eQAwya2/gLU9KJKSw3eMbAygmneACSJy:BeR0PLHoMoQUa2X1OEeACCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896377, "uuid": "12636713-8bf3-450a-9a4e-305096efe6fc", "value": 1125908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896377, "uuid": "64b93a28-c6a8-4e76-991b-db55476c8bed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896377, "uuid": "c9e08c13-4102-4996-8f7b-b3ea84dd48a2", "value": "Bukti _Transfer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d334537-da72-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765884544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884544, "uuid": "a6004def-84f0-4bc8-850f-c9917b6ccd37", "comment": "Malware payload (RemcosRAT)", "value": "330e3a66b4315195c05c0eb2a63c2ca2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884544, "uuid": "aba9cf7e-fcb2-4a4f-86a3-4ecc23f313d4", "comment": "Malware payload (RemcosRAT)", "value": "483dc97c7adc1636ce988ed6e463617038f8e94b2f6687c7ac4934b9caaa509b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884544, "uuid": "9828bdf9-b65d-4b1c-815a-24782f3fa9ce", "comment": "Malware payload (RemcosRAT)", "value": "2cf29bd8cae480e756726fc0616b2b67e593514f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884544, "uuid": "a8af3175-9078-48f0-9c94-da71120c9ef8", "comment": "Malware payload (RemcosRAT)", "value": "e05634e924b10493c4c0f12b681d5bee8c5d947778bea82a93ddcbc04f64653a2a0d26f170ff6b347f16dd1d7d6ffca3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884544, "uuid": "f8964a37-9b18-4997-aff5-ddf9c67f46eb", "value": "T12A0612786EA9F401809674DE9E4C8E4C786206CF1AC10FB7F0629BE5CB34905D275DBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884544, "uuid": "87cd73b4-e2f4-46cf-88e6-b0b7b609c756", "value": "384:Y444444444444444444444444444444444444444444444444444444444444440:9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765884544, "uuid": "520229ff-3f40-4cc6-88da-492247451077", "value": 3733263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765884544, "uuid": "6c80c23f-0b28-4563-801d-264c501e8633", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884544, "uuid": "8fed640d-e140-4890-a53c-8d4e4106ce0f", "value": "Chrome_error_report_22414.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ae54b7-daa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765908318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908318, "uuid": "1706fc7a-04a0-4536-b5d7-30ab3a8cafb7", "comment": "Malware payload (Stealc)", "value": "0bc75a8f0876338dc038a218c0937e83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908318, "uuid": "5a4b9415-c218-42ce-8acd-47d6af037874", "comment": "Malware payload (Stealc)", "value": "485c72adfc4641b73adde7c3e9c998cedb18871710aeadfe561eb7625cb6dece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908318, "uuid": "28008f57-690e-40aa-bd91-d406f8e32a48", "comment": "Malware payload (Stealc)", "value": "154d2c7d96ac91122f7acd94b16b5af66aeebdcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908318, "uuid": "36fe42a9-0966-46a6-ba8f-3b7006faa9ec", "comment": "Malware payload (Stealc)", "value": "fdaabd63fb56e320b75cc2402e55dae97eff1e7db97533d842fad6c26bd29a832d1615093417b5108a1bb888af9c4b67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908318, "uuid": "8420bd0c-cbe3-4652-aea6-4757564c73f1", "value": "T1BF86125572A402F9F5B7913CC8A28E02E776B416077197DF03A0477A1F236E1AE3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908318, "uuid": "fe83967e-6316-475f-96a3-8f4a9ab23d57", "value": "bbb30b604f391c11f7f0aad6186d9b86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908318, "uuid": "e1e8f95b-f2b3-4287-9d7c-e9ab396d63ba", "value": "196608:oFKRNxHiouWJysVYvsOaoyMxxvjDDAxSSEoXjdESNh5:6+zHi9WJdoyMxtDDAxPRX5Ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765908318, "uuid": "d197084b-4c08-4042-a927-849c2fe8a65d", "value": 7898760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765908318, "uuid": "04454bae-05b6-4e3f-8d01-dc6e74593bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908318, "uuid": "66b81dcf-e391-4aab-879c-51100cbd268a", "value": "0bc75a8f0876338dc038a218c0937e83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1271333-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879584, "uuid": "b30a6e59-91b3-47da-9418-539d0b28a589", "comment": "Malware payload (Rhadamanthys)", "value": "7a03d726b5a1b3a83be6ba4fb0b55905", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879584, "uuid": "906c27d7-027f-4a43-bebc-0b4ddb288de7", "comment": "Malware payload (Rhadamanthys)", "value": "489f6dc24c0db739b4e9583cc380fc54f04db0f5e783cf170fee720b8c79678b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879584, "uuid": "39372ad0-a87c-410b-bf6c-42fd8b80d020", "comment": "Malware payload (Rhadamanthys)", "value": "186dff281c7fbc716cc71b52bc090e9786f5f5fc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879584, "uuid": "4f58e6fc-485e-46b3-be11-b6d74e728c6c", "comment": "Malware payload (Rhadamanthys)", "value": "b67d023870cece63ab6699e50a4b768d950cd0e18a56c82f212a1e3cea7d4c4dd4f23297d2e97ac8b8fd417439470c83", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879584, "uuid": "4e8012db-5cff-4027-abfb-f37f3fad30b9", "value": "T101A3095D9D62F8E0B1A671693EC684F0520B3410AF8FA263F01FFB2D6472B2566835C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879584, "uuid": "5354cf7e-5162-4dcf-846e-579d4452740b", "value": "1536:GDB7eKg20FoNy2tOAcUEBnr8oXem8z+IV7fFZlYCF2Wj4hSnOlbOacnUldRrSf2g:GDB7b03mLf/nY6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879584, "uuid": "badc493f-bb39-49fa-b652-326cda9ebc5a", "value": 98119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879584, "uuid": "33f2c942-93d3-4129-b21c-48df850db448", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879584, "uuid": "f45710a4-220a-4c71-a633-5340cc42a252", "value": "invoice-1637482117.pdf (73).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d34ea95-da18-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765845755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845755, "uuid": "b2433496-0d9a-4bd5-a995-0c3856d3a96b", "comment": "Malware payload (QuasarRAT)", "value": "c740064cb510e4938be97d66a4c5ed48", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845755, "uuid": "ffeddcb1-6669-4087-84b9-88bfe7a1d343", "comment": "Malware payload (QuasarRAT)", "value": "496182542c07be3fedaef9250bd859a2465d426a156f64d13c20c0bd85993510", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845755, "uuid": "bc8d72a6-1364-4279-bd21-4bebf408f284", "comment": "Malware payload (QuasarRAT)", "value": "660b2b1d2621de3f8429efecc9354cce72b899e4", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845755, "uuid": "20cfe2c3-9d18-4d09-b033-7453e57724b2", "comment": "Malware payload (QuasarRAT)", "value": "8820037181fd38b2f74d4226c6a2dbac4a88f9b046be9e8602e49e3864976d7526ea72179929a588f8a51b1e58efbd4e", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845755, "uuid": "7537b1b7-3806-4102-aaac-648882659874", "value": "T1D3F54A1437F85E23E5ABE373E6B0041667F1E81AF363FB8B618166791CD3B505801AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845755, "uuid": "e2173d2d-e886-4bb9-b887-a4cdbf2ff5cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845755, "uuid": "8579284b-c735-436e-b42f-4fc4acca97e5", "value": "49152:WvDI22SsaNYfdPBldt698dBcjHLC/1JWLoGd7THHB72eh2NT:Wv822SsaNYfdPBldt6+dBcjHLC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845755, "uuid": "6453cc67-d890-433c-89d8-b2857709f0b9", "value": 3333632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845755, "uuid": "91ba38d2-1228-4c39-9e94-16df4948f05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845755, "uuid": "2ba6c0ee-7a9d-4ad7-a992-b108d16a186e", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09db484-da73-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765885059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885059, "uuid": "8036c095-b14c-4d2a-8071-4bf0f0736994", "comment": "Malware payload (Gafgyt)", "value": "d86653f1060ffb25a99245a220a93c60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885059, "uuid": "3a664161-26fc-44e1-b61b-edb4c7f6b64b", "comment": "Malware payload (Gafgyt)", "value": "4a3046627f485bc8b14a08cc7c7480a2672595a35ba011be5a30043de47c2041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885059, "uuid": "56022af3-bf19-4a62-8978-dabfccfec6d1", "comment": "Malware payload (Gafgyt)", "value": "1768fd984b17e7fec2a6ee0ddc1b5b08bc21bb40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885059, "uuid": "8da035ec-cb56-4b94-9677-0f801874ed81", "comment": "Malware payload (Gafgyt)", "value": "23e02fe52d72f6bb60e9705302537dbaedbbd2f27f8f67ba5def5e23d7b3389e629051f1c03284fcfe5f533df20e6b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885059, "uuid": "fa0684c2-39c6-4733-ac16-a1d444e6d075", "value": "T16FA30A54BC548B55C9D023BBFE9F118C33165398D2FEB22BED105B95B38A4274D3AC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885059, "uuid": "8995b52f-5a50-40fa-bd20-821e013e869e", "value": "1536:aInIfIe1QremfOp1FK+b7pQ6kYw3xH2DdP38wcTsMEwnZzM+i8Dvd1izVns54uua:4hfNw3xH2DdPaTsEDvd1izVns5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885059, "uuid": "03d96a59-aafc-4d72-85c0-183375d071bd", "value": 99752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885059, "uuid": "a0c1d2b3-dac4-47c1-b6cd-f4cba3c496f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885059, "uuid": "5e4f4823-5a64-4323-9cad-2fdb1ef02141", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c292db65-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905303, "uuid": "b31ff030-40b0-4f92-9306-9ac1139a3338", "comment": "Malware payload (Mirai)", "value": "19d92fa7d00eed4e29a7fa759b64e862", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905303, "uuid": "cf0bd927-19e8-4495-a12c-dcb68386f852", "comment": "Malware payload (Mirai)", "value": "4a83be793102773fa9bf2c84ccc64de4c671d14bd02c0f8a62d81c218f45ccac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905303, "uuid": "9360a98d-3150-4508-b1e5-93fb2545259e", "comment": "Malware payload (Mirai)", "value": "0131a21f6b39d3bc8cd70a0d53b1a449744d58f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905303, "uuid": "a0770506-acc3-47fb-bb22-738012920287", "comment": "Malware payload (Mirai)", "value": "35880646a0a1baf89aa93cddba06690b2bae3a4d24a5f1642b45a47c4e537a50faf36707258c775ed02486ff7bd41651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905303, "uuid": "0a479605-52b5-4ff4-b44d-5fe4c014e280", "value": "T139C3F8456C51CB21D9D323BFFE5E55CC332213A8E3EEB1179D102B597B8A02B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905303, "uuid": "c9316cbf-6bde-4832-9f77-d90229709cf3", "value": "3072:UXzJWVNewRV2qK+5XqgKDpeUz/Sk5Vnp5Tu:UXlWVcwRVs+dzKDoUTp5du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905303, "uuid": "5400dd5c-4513-43c3-bac1-cda6ddc7f245", "value": 128192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905303, "uuid": "84408094-e386-4692-b30c-90e7a428294a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905303, "uuid": "a85d62da-330c-428e-80f6-9ee142ccb455", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8455b9de-dad6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927532, "uuid": "84eb7e8f-bf34-498f-a58e-e872d7091827", "comment": "Malware payload (Mirai)", "value": "c99102c76b09f5e371861fb78151c247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927532, "uuid": "42c61cd2-a6dd-4a39-ba31-5ce871cef4f4", "comment": "Malware payload (Mirai)", "value": "4b13557af1ca7e99a904f476cc1a288525242130d1eda78a51351c12762aef5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927532, "uuid": "cf4d05fe-00a4-46c7-9cca-755d80686a7a", "comment": "Malware payload (Mirai)", "value": "40465f83c80840382c3f097eb7f1a3633fdecf86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927532, "uuid": "eeb7c396-462f-4c12-8aad-52c99597a928", "comment": "Malware payload (Mirai)", "value": "835caf9a7528b91849e805b6d95fede1743118d93604993b7e54e8e83a876fcaf82cd2a44bd524c86f32f75d158fe9c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927532, "uuid": "6d31bd26-f84a-4fdc-b52c-ace724eba0bf", "value": "T109D33B12BCB57E3BD0D460BB52D38533F5BA1B0910A8C62DFC610D9E9E35960266F6F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927532, "uuid": "67791015-8977-4829-8727-bc56713f58ba", "value": "3072:VIn0zNdbGfMrR1LAYDs7++z5OGHM4hjNEBMMMMbJ:7BxcGxX2++z5OGs4aJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927532, "uuid": "f3383aeb-d28a-4119-9cb2-f03c96b1b1de", "value": 132300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927532, "uuid": "ded495e3-2281-4cac-b813-79a00c16c9b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927532, "uuid": "876b4543-51fc-45ad-a80a-b39e302a7a40", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d63e57e-da8b-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765895201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895201, "uuid": "8fb0e21c-768d-4129-99bb-f1a48500aa6c", "comment": "Malware payload (PureLogsStealer)", "value": "7efdd3383dc8ea8ec379e6d221809e68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895201, "uuid": "12ad63ff-7516-41dc-bd2f-3576d19900d9", "comment": "Malware payload (PureLogsStealer)", "value": "4b41afcb103f73ca220370a6e0bc97bed214e6d5cc4d5c58810c81eb7e4efff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895201, "uuid": "a23a0c28-f86c-428c-abbf-fb7ff83a74bf", "comment": "Malware payload (PureLogsStealer)", "value": "35dce04f54f1d7218b6dde248c3d929feca98e39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895201, "uuid": "95ebacaa-3c8f-4b37-a07f-d28c79cb806c", "comment": "Malware payload (PureLogsStealer)", "value": "2640cf18dd3aa4f038cb43d3c64b10b6098a0a1d283af23281cd0cf852a5faa9135cd827aa032246f1463d9b4900e01a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895201, "uuid": "d861c6d8-f1cb-4f5f-bdb4-4ecd1deaefdd", "value": "T1E4B649521336A7D7F62311FC893ACDB961D46E23A6E1BA9337F47E1B35B11C23025922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895201, "uuid": "7385b64e-736b-4cb5-bf10-adcb7e2181b6", "value": "bf954613bb0a5a02b61a3909d74f75b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895201, "uuid": "9c6d33ea-cfd7-49ec-803f-436d73499121", "value": "98304:I7TtZMmYuvkoUdjGwvliGamHRReZ8iuGZDF1+O56ZnVZ4oxbp333l333q93Yeq2:ITGVTIZ8iuGZx1+OirHxS1Yeq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895201, "uuid": "1b91ad99-5636-4b89-ac62-d0e7697b5d55", "value": 10457600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895201, "uuid": "20955d24-b486-4722-aa94-456844bbf088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895201, "uuid": "b4b32dc0-74ac-4c7e-9c91-e2ca0cc56f34", "value": "4b41afcb103f73ca220370a6e0bc97bed214e6d5cc4d5c58810c81eb7e4efff4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad5b7f0-dad4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926496, "uuid": "b28a5499-b1e5-404d-99e4-3686b0174724", "comment": "Malware payload (Mirai)", "value": "fba3ccfd74cd1cba28d536739e245b6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926496, "uuid": "1fdd7490-d9ed-428d-863d-5758dfadcf27", "comment": "Malware payload (Mirai)", "value": "4b61f711e6fa604cb55791fdaec4198432314cce79afca1e7e754def7cc8eae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926496, "uuid": "86787c22-9cc4-4e07-9eef-b7afa9f80ed9", "comment": "Malware payload (Mirai)", "value": "5c816be74fd55fd508cd26a8523e4b8be1f77476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926496, "uuid": "c985b5e2-1c8f-4b2e-9d15-e291c9094bed", "comment": "Malware payload (Mirai)", "value": "25442c8dfdaa9e55ca45e09f30d42c9365eabf8f8409278a9b40d86750321965c25ba5638614789fc9b4234bc5f46b70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926496, "uuid": "74e345a3-8473-499b-9bba-f6734e30336a", "value": "T192E3E649AC818F61C9D7A3BBFE6F518C331207A8D3FA71169C1C5B55738B42B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926496, "uuid": "2c61313d-8059-4c4c-9743-c6ec4cb7e836", "value": "3072:lv6CW+FLQmvC4GFhV+cUmpADOEw6lfEDnZFVnKz5:lv6F+F8mvCfVtUmpADON6lfInH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926496, "uuid": "1bf7a5f3-0473-4267-9f6d-cfecae126cc5", "value": 145060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926496, "uuid": "1a1e558a-6a1e-44a5-8e9f-5a5f588da245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926496, "uuid": "080d4ed5-08f2-44ae-993e-04c5da1ef29f", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab8fc34-da8a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765895089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895089, "uuid": "d499180d-6b2b-462e-b73a-a4bd571255eb", "comment": "Malware payload (Mirai)", "value": "86c8438f151b1e0bd926a463d804ec52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895089, "uuid": "2e5f9a14-34d6-46c8-bf4c-d696b7174f80", "comment": "Malware payload (Mirai)", "value": "4ba942d62e1a0e2cd3c37ce8153175b55f179243a38c8e89486b893dea51db6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895089, "uuid": "6f72f179-336e-4097-8bae-b0f0fb908568", "comment": "Malware payload (Mirai)", "value": "7e016d4c3a98d93052ad3231c2e2175a6ce16022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895089, "uuid": "5106f223-210b-437a-8956-4b4bb60382ac", "comment": "Malware payload (Mirai)", "value": "5359080744f798bcc8c3bcf9a61dde15ebed1132f4cba91f48c29b798cabdb426854bc1fbc3f9041edd8ed1ec305668a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895089, "uuid": "d803d024-2043-4e9c-8087-88ab862f78d4", "value": "T122B31891EAD3C5BFE825013551325B328634FB3E907FEACBFFA89930AC1024195597AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895089, "uuid": "5893d4fd-5a35-4dde-aa02-eb5ba640f586", "value": "3072:bf7VetgGp5fVat+A/wyCJ4QPIyw5XhZZHZaoD:bTVupxW+AbCJ4QQyy7Hao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895089, "uuid": "901fad50-3078-4f1a-af8f-b3dd0935dca3", "value": 115664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895089, "uuid": "daf2d704-0073-46ed-9002-c94cc414cedc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895089, "uuid": "0fcd4771-76e7-44df-9c87-a99b6d44ace7", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3669bbe3-da81-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765890894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890894, "uuid": "6c1195db-896c-42f3-8c1b-3ee2894a3386", "comment": "Malware payload (AgentTesla)", "value": "236f4bacbe9af9df64f56f31c57a5e92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890894, "uuid": "caaba8b3-0d89-4b93-9409-6acda0611089", "comment": "Malware payload (AgentTesla)", "value": "4c17bb4452f6fde01d9dfd78af737ba53019f9b7bb8a983044a34d96753b2445", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890894, "uuid": "ebe52348-43a0-4c58-ac2e-93cb39c3b27b", "comment": "Malware payload (AgentTesla)", "value": "855398a6e347a2c0fd82fb6d8ad91ffe79730247", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890894, "uuid": "02a7a4e4-275e-4d0b-b0bd-6fe266f5c719", "comment": "Malware payload (AgentTesla)", "value": "1f3a1538726986dd6163b7f770d98addeff5616547b9f4c94669f6a6ba1bce8c0746ee69ffa69ad766ab78b24f5b5be7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890894, "uuid": "499cb773-418b-4328-aa66-23a2a51f5ec4", "value": "T18092D1BF6D64DC6DBEAE537283363A27627E84D5A1C15520EEDC8188641300F9779F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890894, "uuid": "3c8e32d8-a18a-4d52-aa43-9e9b9c3115ac", "value": "384:FrzejZ89UlsSgiplv/A+Ot/G7sG2hbg/Jox2SFBRvJ:FpClRgWA+OtO7airuLvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890894, "uuid": "a7e670af-33ca-484c-8310-1eb8ef20e4b7", "value": 21025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890894, "uuid": "73494eb2-355c-46c0-b5d5-5aca16b690cc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890894, "uuid": "ecabdc3b-6243-4d91-89e9-7888109f607a", "value": "2025-11.20-1051-001.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fd8995-da74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765885278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885278, "uuid": "96636758-62dd-4dec-afc0-b218eaccf217", "comment": "Malware payload (Mirai)", "value": "dcb5963ebd3b8f0895aa94d05cbca70b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885278, "uuid": "ebb9e85d-dc2c-45e5-916b-3e3004fdd25f", "comment": "Malware payload (Mirai)", "value": "4cb6e0fa05db62570b3a2a26c6a992277ccfdcd65f553871eec21c63b8b9e16a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885278, "uuid": "921a4dfd-a0a3-4bc8-8592-173c8a905197", "comment": "Malware payload (Mirai)", "value": "4a5759c31027b575aeb6b4fe172f2030b448124c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885278, "uuid": "64b0a262-e114-4550-be08-d2a0086b7593", "comment": "Malware payload (Mirai)", "value": "64a751f25a2ed3829383b76d2c4ea6821405377c8d14434866e473e3e2b82928454203e050c0fe7f7789741fa669a42d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885278, "uuid": "7d808cb5-ef9e-4eb9-bf3a-a26c056295f0", "value": "T127F3A2087B611EBBD85BDD3746E84B4919CC610736B83B3539B4E904FA4B58F0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885278, "uuid": "9531be3b-3933-49cd-9650-574e608108c7", "value": "1536:UsyN5EV+YV2ud++slrSUIFMRbh7xrKckP0KHyDFEGythnRNIP/l4v7unoBwDFZ8+:Usvc7uddslr/bXryX4tRlDr8nm5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885278, "uuid": "8374d814-4b8c-4d75-9d09-39782eabfc57", "value": 159672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885278, "uuid": "d72404cf-1d78-4fa1-bec9-f110079695e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885278, "uuid": "555b0bb7-9316-4c1f-aa31-a1862763d5fb", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a28779-daa4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905851, "uuid": "84966b9f-ee0a-403a-95d8-41c3a25f664d", "comment": "Malware payload (Mirai)", "value": "06b102c5322dc1c51a5b28eb775826e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905851, "uuid": "c6f10b0c-7320-4ec6-b632-584434b20b86", "comment": "Malware payload (Mirai)", "value": "4d10972bae0a11752741ff65289bf069d3e43d9b5b900489b77bcfe8d46f61fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905851, "uuid": "189377d5-c66d-4eda-99c7-80f5f7a953aa", "comment": "Malware payload (Mirai)", "value": "ebf63e8590e93da5154de9878d24d495fd6e06ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905851, "uuid": "fda83bd6-ea67-48e8-990f-bdce269c063e", "comment": "Malware payload (Mirai)", "value": "b82e30a5e5c795e7f5b179fcf02221370eff5bd4518ef792af0c8da83d02ec9624c62e3f250babd3d4f58a5b1f534bfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905851, "uuid": "cb0737eb-6497-4381-a983-706c0a9d7c7c", "value": "T188945C5377028F62FA1690B14BF7C7A539E410C31AB699D6E3118B9C7F122E97C1ADE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905851, "uuid": "1ebafecb-8f49-4295-b93a-5fa5a318bd4a", "value": "12288:7ZErEbwpqc+LrN8TtyHMZeDIlq/Ex27gdi38JOz4Vav0hmrQNSns5+joFK16PUB+:lcCLrUtyHMZeDIlq/Ex27gdi38JOz4V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905851, "uuid": "8b3ba40e-2066-49d2-8359-13d25176b462", "value": 420752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905851, "uuid": "d506ee61-cbdf-4497-a882-21871ea8a2cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905851, "uuid": "d6eb4a19-b3b2-4174-8b03-a850f6004363", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c33ca7-dab3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765912363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912363, "uuid": "e81aba87-1ce9-492a-98cb-1e6ac6ba7313", "comment": "Malware payload (Mirai)", "value": "6f4ccbc4c64c441b2b520bc74b9f039d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912363, "uuid": "e76023b8-9dd2-4cd3-aa76-8df7356e7284", "comment": "Malware payload (Mirai)", "value": "4d3d2c9f46dac581c4925d1efc92b87ff0f98a5eaf87bf15309f3f1263648b34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912363, "uuid": "1351f0a7-ed49-432d-adb4-cd6176b2a5ab", "comment": "Malware payload (Mirai)", "value": "152be10d3f8b57abaa1ed5c14cc0bf80cd18dbe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912363, "uuid": "9a551ebd-252f-4b97-a961-fc1f6c736188", "comment": "Malware payload (Mirai)", "value": "3758bd0ef504700d5785e5f66e707a410fe75e4f7c1f89fe6dedd0a3c79b9460560991f5b75fb5487ab73aa6e29d825d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912363, "uuid": "096822f1-7943-4270-9561-74ee7d4f6fa7", "value": "T184D35D21FCB42E37D8D4A0FA52D38632F5B51B0910A8CB29FD720D9CDE3562427AB576", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912363, "uuid": "fda52083-b106-4cd7-8ba2-9bf77dd4592e", "value": "1536:3sdJS6nJ1z0XO/bmPZezrVWgS0GKl+N7Dej9zzRIOtUF0ivOv39bjAacZX6tsEnQ:3QwgAXXOWlejrTg08amXWQjNtB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912363, "uuid": "1833e067-a29d-405d-a250-e248c9365425", "value": 132300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912363, "uuid": "b38fbe86-721b-4052-8c51-e01ea754a4e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912363, "uuid": "b0cb5f39-b235-433e-ab70-bb060bbde8ec", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206a95ef-da85-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765892575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892575, "uuid": "a4eea8f2-6626-484b-85d5-ff4dac738d8b", "comment": "Malware payload", "value": "c420ae4cb5474035f01c2140945cd1e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892575, "uuid": "7e1f887f-2adb-44e5-b0e5-3b6f0ba3e645", "comment": "Malware payload", "value": "4d98ae2630cf914dcd856e7a7992f2c638e8f2c087cbafbb3e06a7f7b9df6861", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892575, "uuid": "88ac9987-1489-4edd-97a1-4dc8280dd5bd", "comment": "Malware payload", "value": "b4a632f7a1480d55b1bbe83f6e48d8de115260d9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892575, "uuid": "6219054c-2306-4956-9ddc-a475ec08dc89", "comment": "Malware payload", "value": "ed58ceb594f7e3916379098092f7ab2a5f8f618678044761ec2d5fbde41441c1f8031820fc2844e0eb8c35f7cd5973f9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892575, "uuid": "76dfb402-4db1-4f16-9784-ee402484c879", "value": "T1C3663AE324C3E6EDC426C47E8253FC7F868FB0374516A5E39295B3665E16E403626F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892575, "uuid": "e2b01776-eacf-4d9b-988b-a599aa8d37c2", "value": "e03ef74306b26ad4cef7b98078bf9cbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892575, "uuid": "b1dc16cf-d46e-440e-9598-01207c492ad4", "value": "98304:R2Hr2Z4TIYv24It6FkSMsVmT9QZT73bXGj1K4GYOuAJqnBD:R2HaVaTzTGczuAaBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892575, "uuid": "fd780e84-3649-461a-b688-f916302f379a", "value": 6704240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892575, "uuid": "96fc3686-7237-47ba-b698-210eaeb518f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892575, "uuid": "c1fd3c58-188e-4dd0-93b8-4bfaf02583af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea45b683-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765896350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896350, "uuid": "7ac893e9-47ff-4dc2-ba80-2059134c4464", "comment": "Malware payload (AgentTesla)", "value": "eb58638ee3b78acc50133601bd12c754", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896350, "uuid": "4ced13d6-9002-4313-9b06-974f54a92cf0", "comment": "Malware payload (AgentTesla)", "value": "4da8958c1a74676b7732cfb1d03194787e4a43836633b55a1b1daf61db94c3f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896350, "uuid": "f27d7b0d-7f2a-4f43-a2b2-81a1d7e8665e", "comment": "Malware payload (AgentTesla)", "value": "0609fe703078bce01acbb0485a91291370ada064", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896350, "uuid": "6cad342e-b478-4310-a845-cc9dfb4def9d", "comment": "Malware payload (AgentTesla)", "value": "a823ed663117e58dd7b60e7a387f17ba7f2bec964280f80f7da599b9dc84d45f2bda19e6f2aa08f21313d8428a991f06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896350, "uuid": "934b06eb-b456-46f0-8a48-ad1c533340c4", "value": "T13345F1114DC42FB9CEA89A1890FE150EA3F05A8E542A758EFB3B7D466FF7A44010F1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896350, "uuid": "968de56f-c7be-43a2-94a2-b0feea0172e9", "value": "24576:l0z40XA5swObBzRJFVEfvehuHHYTEbjHuB2gM8PdoF9t0v:Sz40GNyHWveVTY0W8loFzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896350, "uuid": "1b17840c-cde8-4e6b-90b6-7af0c6b82b55", "value": 1248688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896350, "uuid": "f98613db-da0f-46f8-8ccd-0050599bb0f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896350, "uuid": "deb55766-f64e-4565-9e58-a0cbfb6a55b7", "value": "IMG00012516.PDF.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7713a595-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879836, "uuid": "a7a9800d-8b35-445c-9763-1a324801d28f", "comment": "Malware payload (Rhadamanthys)", "value": "b0f968830e028355b8ebbf8cd9aa0e53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879836, "uuid": "374c43bf-08f9-4fa2-a7ca-d92590e2ea03", "comment": "Malware payload (Rhadamanthys)", "value": "4df1fb6ca864ce8d4ce6a55b777923edc576b5f1b78667cbde35c5caf307c44a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879836, "uuid": "3ae2b534-5592-48da-8d10-2d2f5199cccc", "comment": "Malware payload (Rhadamanthys)", "value": "c9bdd855eb18c0d0e0ddcfc986e3ef6fb60b7fe0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879836, "uuid": "00663b5b-ccc1-4419-aa52-853a01ef7492", "comment": "Malware payload (Rhadamanthys)", "value": "cd81857278da6be21721d9020fde739f6633fc075ded8d21719c03f0b91e3fd60b7c9354741edd5f42cc31dc2af98e04", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879836, "uuid": "916fc864-293c-48ea-b09c-475cfd50d10e", "value": "T1A4930A111B39F8B669D673777A4411F7C80D566A8E4EBE4AB2CFE710A10CB8509887F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879836, "uuid": "36ee1c36-ef81-4b43-8f5e-32414630070f", "value": "1536:GDB7eKg20mGosyvO0PvS3WjOIbgDQprxg2oBIRBFNjLYagdGQTRtzImB/rHKNmr8:GDB7b0mGosyvO0PvS3WjOIbgDQprxg23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879836, "uuid": "280aa500-ad7e-4b96-ad59-df79526b5d82", "value": 95408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879836, "uuid": "48e612fd-e6bc-4fcd-a919-defbaf845896", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879836, "uuid": "a58fe163-8fe4-4296-be38-eac798d83812", "value": "invoice-1637482117.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c32332d-dad4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765926498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926498, "uuid": "b91d3ed0-a0d8-4df5-aeea-9e4e70ff5a5e", "comment": "Malware payload", "value": "103e68774e9be08ebcf8226b5c267175", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926498, "uuid": "a0487bfa-b699-4438-8981-12c657d002eb", "comment": "Malware payload", "value": "4e95334ee4d507f28fe0895dbb6d895cef6b620283e5d7b2c181687ff4f72359", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926498, "uuid": "653c8c17-023f-4ac7-b768-b38b26bc906a", "comment": "Malware payload", "value": "f7bdb64402e03e858553d466aca7f1bb7425673c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926498, "uuid": "9f81cee7-0d4b-4daa-84e8-792022d5485f", "comment": "Malware payload", "value": "ffbb4ee95209162c4e6ddc3ae4228c413607681da706b802cb6594696de8a6af822881efe2913c14a45702a4972b7431", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926498, "uuid": "7b4d4733-360a-4b40-8bde-586880969636", "value": "T1F3B3F855AD808B65CAD7237AFE5F129C332253E8E3EE7116DC102B5573CB11B0E36A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926498, "uuid": "0f5ffae6-17e0-4bb4-8fc0-016ca75cb6f2", "value": "3072:vQuxok+WcSCG6+K3OIINgG3kTSPv2OVns5g:YuzvcSCG6v3dINgG3kePl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926498, "uuid": "1d20a714-b21d-4d1d-83d3-aec49cd8a7cf", "value": 113236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926498, "uuid": "c325c5cd-06e0-4189-a33a-d87f16f7daae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926498, "uuid": "76be31ad-2764-42f8-904d-700bbedf4e36", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46abfa8-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879509, "uuid": "ae3df5c8-b13c-4791-8809-88dc79c201e6", "comment": "Malware payload (Rhadamanthys)", "value": "b979dbabd48f4b6d6dba76272adef334", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879509, "uuid": "efb1ca83-43b4-49ce-ab07-c975a80381f6", "comment": "Malware payload (Rhadamanthys)", "value": "4ea10b776c81aa01cf98e885f6c93c5237aa164319230514b16c17968e29a133", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879509, "uuid": "47cb20a9-b0e9-47f1-92d8-ce1135e66ebb", "comment": "Malware payload (Rhadamanthys)", "value": "8171a7174bfe5e10d68f0d11691def73ab06a873", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879509, "uuid": "7b1cf081-1023-4553-86af-0d841855eb0b", "comment": "Malware payload (Rhadamanthys)", "value": "02ee39f95774847ab9daee20cb08a5d42b98a8a3d358da2cf54dd1ef242385fbf2016592e1718492f57369386e2e6184", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879509, "uuid": "b4db2faa-d9b0-4f41-bdba-23d1dccbb1c8", "value": "T136A3FA327F3FF5F0229910523E8A1666860E7702F8336416CC8FF2797E9C76A2593655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879509, "uuid": "9aefb22c-4450-44a4-9f91-489e3a621600", "value": "1536:GDB7eKg20/R101WrLrOIb+2AqUF6BkQWJ+aY:GDB7b0/R101M3jKoUF6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879509, "uuid": "6195ba76-6d80-4d69-80af-9b950d827f23", "value": 101482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879509, "uuid": "424769da-a265-4240-a6d2-586b697730ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879509, "uuid": "b5eeaf7f-1ea0-4e3b-82ed-307385ad48ad", "value": "invoice-1637482117.pdf (86).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4506daa-da94-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1765899266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899266, "uuid": "e9cafcaf-c61e-413f-8b27-ce2da9ff6a8f", "comment": "Malware payload (ACRStealer)", "value": "7d010eba05f4035a9a253aaab0bfa020", "object_relation": "md5", "Tag": [ { "name": "212-118-39-120", "colour": "#BC6232", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899266, "uuid": "1c124902-6071-42f6-904d-246df9927d87", "comment": "Malware payload (ACRStealer)", "value": "4ef406954be4d48f8e33ed0048747c16fa10239e43119ecdf031d128b19df1d5", "object_relation": "sha256", "Tag": [ { "name": "212-118-39-120", "colour": "#BC6232", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899266, "uuid": "275e9268-f1c0-4466-ac6e-9db76588ee02", "comment": "Malware payload (ACRStealer)", "value": "1c7ef324bedeb3c5176eacda4aa44a3c28007c85", "object_relation": "sha1", "Tag": [ { "name": "212-118-39-120", "colour": "#BC6232", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899266, "uuid": "b16ccda3-1302-4931-a107-89784fa39da3", "comment": "Malware payload (ACRStealer)", "value": "c259e2d230d5b434b175fb38a265937282e50f0273057faa074eb8d6bb84601d549bbcee47e8cb3b1ce0b6cc9c39e8c6", "object_relation": "sha3-384", "Tag": [ { "name": "212-118-39-120", "colour": "#BC6232", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899266, "uuid": "af4d4a46-b6e3-4a19-be7c-fa551b62414b", "value": "T1B6167C31E541B174E8F924B3A2FB4BB748E59D483726D4D3A1D538C486722D326FA28F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899266, "uuid": "6671e2cc-aac5-48ea-a746-2a39617a8a36", "value": "4200aa356213a0a1ae7ebccde91ba4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899266, "uuid": "fd3f17e3-6899-4526-98ad-6939627f56c9", "value": "49152:2SnOn719d1FqAAIEtrGcNvPdX2I7WEHPWnHMTPpPOUSaOq2GI5e6qDa:2Ttbq9xtf1X7zHOHMFPOUr72teXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765899266, "uuid": "a9985d48-be08-48f8-b562-0a6cfe45f26d", "value": 4328824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765899266, "uuid": "fe8106e7-f171-4263-aa4a-cef40927b5f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899266, "uuid": "3c7c17fd-406c-41bd-aef7-21597df860eb", "value": "python310.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2d5841-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927141, "uuid": "3b56f3f1-ecb2-4cdc-940f-a80e6f7f663e", "comment": "Malware payload (Mirai)", "value": "911883be13e4522ae56909aecaf2c0b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927141, "uuid": "ef167de5-753d-4ce6-b614-900e47a27b11", "comment": "Malware payload (Mirai)", "value": "4f3b1ba0a289b45ad676ef98f733cb23b2547809bceaf1c3693fb490a54cb639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927141, "uuid": "6b5231c1-cc79-418f-862f-ce18faacdf25", "comment": "Malware payload (Mirai)", "value": "dd6b1a5e8eaff4de5ef6963b22db02c0a28f6e9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927141, "uuid": "22154c75-4bdd-40e5-bdd6-b0c2b792afb8", "comment": "Malware payload (Mirai)", "value": "94117880daeaed51f844c2ed2088e329883a5979366d66505467d7ca47a2d8078b10841171f35fd24f1f77632fcfb43c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927141, "uuid": "ffddb301-8ef5-4ee2-9030-e770fef30f79", "value": "T1C5F33B06EB418643C4D617B6BA9F41553323AB58E3EB330689386FB43F86B5E4F63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927141, "uuid": "8156ed1c-b999-4fba-91ee-e3f21e9b365b", "value": "3072:BxIfB17B4S/WSwlKTCi1eY1nSaBa1l7ZCbzUUIjM/9kUBW:BiB17Bf3wlKTCi1ewnSai0bzUnM/9kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927141, "uuid": "882e5814-4e50-4f93-a57f-4e006805173d", "value": 163869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927141, "uuid": "186403fa-4422-483e-a1ce-7799f42e4d16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927141, "uuid": "5169b9de-5479-42ea-8011-b20029b071e6", "value": "shadow.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e2d242-da8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765896556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896556, "uuid": "9b9431b4-a4e7-4259-ae4b-d24cea8558a7", "comment": "Malware payload", "value": "52f3fd920d43bb4e6e60b187d7aaee03", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896556, "uuid": "51726269-d803-47c7-a496-55652b83a773", "comment": "Malware payload", "value": "4f3cf76445ff0272bb7ff5724b6d3faad968d2bd7f927bd38d87be372ee0d75f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896556, "uuid": "0d685700-0c22-4530-901b-3a252b97d0af", "comment": "Malware payload", "value": "7b1451b1e1883df7bb7b92ca120076d4652c8b24", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896556, "uuid": "63582b4a-2b8a-4062-b25d-d3ddcf7147af", "comment": "Malware payload", "value": "c461e55c4ecaff4aba5b1429249fd84fef9aa5ed74e4c0c2b7708fd25ac9112c0d71633e9df5ef966bdb874eaeed7975", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896556, "uuid": "e8a77618-eb1b-4971-a122-3ee335db4c4c", "value": "T1B605CD71DDCA851FD70175FB17882A9033039512C2B1D6A634ACED4A33BB27E6D9623E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896556, "uuid": "d017aaee-bd37-4483-bc72-772f433c06ea", "value": "384:SQn0KPdFSPc6qUHT8SVSoOlAS1zlTueFTovofAlM9HUVRYPbgOLG2texFJsNZrsn:x3sz8SVSoGiQNxUVRYPbgOCsc8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896556, "uuid": "08a6b5ba-ab33-4c76-b110-4a3dbab3f8ab", "value": 851194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896556, "uuid": "6bf38e87-6417-409a-be9e-5bccc4b69c8e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896556, "uuid": "8dfe5040-5707-48b2-af42-431b4238e5c0", "value": "DHL Receipt_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd769372-daae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910448, "uuid": "8d65bed9-0903-4d4a-a7be-ef8b17e4a252", "comment": "Malware payload (Mirai)", "value": "0c3617e8bdfc18057cddaecd1a0a8a78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910448, "uuid": "24c7ead9-d87f-407e-8a2b-81c1f9adbdbb", "comment": "Malware payload (Mirai)", "value": "4f720c2db1da4d28c3853b134d5e824613fe59feb20517ce762f077313762d38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910448, "uuid": "9303040f-f82e-4beb-aefe-8bc5d82bd7b7", "comment": "Malware payload (Mirai)", "value": "ea9411511ce70b8a186ca3ed9db77f5201732131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910448, "uuid": "e32bba7a-52fd-4c6d-8ab9-cafef4e05492", "comment": "Malware payload (Mirai)", "value": "62179b8024dbd3de152f18709f8e2d2cfd97521158402bcfdba72b22db36c4b5768d8b8196dbe2b54ceb4f7ea427db37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910448, "uuid": "65eee0d2-05a5-48b8-8a89-97f5c49a518c", "value": "T102A3E983F3194303F06A4FB66EBF67E8DF9CE9A01168BE4C251B61094072C764756EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910448, "uuid": "6d8c1e76-581f-4c54-b66e-4e91dee2a2e7", "value": "1536:Ms2UlDJBbjPi6L+HlRNuXMx46VVsldlF3Nzu83l8ndo5D99:rzJL+HlRNu8bTsbDNzP8nm5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910448, "uuid": "e8cfbd2c-a227-4251-801b-2eceb31432d8", "value": 99604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910448, "uuid": "871426e0-4c95-418f-8228-38aee6e2ad07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910448, "uuid": "07e7247e-843d-4d44-bf53-14bb622d9732", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23bea91-da18-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765846112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846112, "uuid": "f2c113e4-d022-4c35-aad4-14614563f8de", "comment": "Malware payload (Mirai)", "value": "acc8ed7f46d3a3cc1b4f61b725647f5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846112, "uuid": "62481451-e6ff-4bff-a95b-6414d14aacfc", "comment": "Malware payload (Mirai)", "value": "51039a10991462969e3d3167a9ee26d2c119ac9abb426a9d960a36f4283b531a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846112, "uuid": "cfdf16be-8eb6-46e7-be8e-29cd87aaa098", "comment": "Malware payload (Mirai)", "value": "c78d21e5f2635896729f335ddf37630f21298967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846112, "uuid": "dcf6604c-991c-4f19-9282-5a8b9d0fa4d4", "comment": "Malware payload (Mirai)", "value": "26f615074069e33822611c12f104773f127495194c7591dd206d5e31f3d2a20af5425bd9d53199fd01f8e9c8ed7b3bf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846112, "uuid": "cfe8e7f6-9bf1-4367-96e8-49b793d42e34", "value": "T145C30846F8819B15D5D111BAFE0E124E77231B3CE2DE73029D24AF747B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846112, "uuid": "df5e2822-ac17-49ed-aec9-e730970bb808", "value": "3072:1iTsl4XTAuSNhb8hP8SoqVMaF4a9UTVI:1iT3X0f8hPXVMaF4auI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846112, "uuid": "83cc9137-61f8-4ce4-9454-9fbf3148dbd9", "value": 122576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846112, "uuid": "686ec477-4b8e-4692-9355-a8de9ec10871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846112, "uuid": "1c81faf9-5544-44c6-a520-9622b1b39814", "value": "nuklear.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e30a65-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879651, "uuid": "9654c4d0-dc8e-4a21-9332-60b708d307ff", "comment": "Malware payload (Rhadamanthys)", "value": "e39d544166bedb54b23ee4e561607939", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879651, "uuid": "e9f440e9-61a8-42b3-90c8-9f3198755ae2", "comment": "Malware payload (Rhadamanthys)", "value": "510bd68df553f92613d79d5912538bacb86009ddfc6cb8e6567c3acb7e635c16", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879651, "uuid": "f64bc637-0cec-468c-a6fd-2a16c2e13d14", "comment": "Malware payload (Rhadamanthys)", "value": "5395bc34259a10acf4ee9903271b4d54d260c6cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879651, "uuid": "13074d16-c8e6-4bc7-b293-6b0225523edc", "comment": "Malware payload (Rhadamanthys)", "value": "2e8d013b493272c1d63500410c1eaa59c8b4b78be367f3a0612e260741d8fd15b096a5b3263e5bb5c39d48f86988fc79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879651, "uuid": "d5f2cd65-4a41-4d50-a8b0-ad393f792bee", "value": "T1EF931A66986B58345E299D8C1CB826FDD24DB6300A44C1A8BCCEF2570DBCF761CB15EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879651, "uuid": "108af01c-cd54-4a8c-8085-c208294f6ebc", "value": "1536:GDB7eKg201yeFptgh3yg/G1hTbaBSS6+j2UyCysymyJyAy7ypyoy+YrWtlWqQpJG:GDB7b0SJ7dclAstmP6e73r6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879651, "uuid": "179685e2-bfe8-4cef-aef0-ca1828a87375", "value": 97373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879651, "uuid": "305167e1-2fc5-4e09-8864-fa54b95f2ce3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879651, "uuid": "7dc65440-059a-4996-b4ca-f97c8b6f0860", "value": "invoice-1637482117.pdf (63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc185be-da1c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765847524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847524, "uuid": "2e21f9f4-1fcd-4dcb-91f9-feb19c8e7e8e", "comment": "Malware payload (Mirai)", "value": "abc4aa10ff75dd3688dc98dff845d300", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847524, "uuid": "a59baf96-3ce5-4f22-8e4b-6f07c86e84b2", "comment": "Malware payload (Mirai)", "value": "5133a7b585f349a50b3a19b86fa1d0507037233fb4eed7edf2af75c3393de4e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847524, "uuid": "2afc712f-b88c-4a8a-94df-6abc95298b6c", "comment": "Malware payload (Mirai)", "value": "2a7731b06c5531cdf441309f82be45a330e97804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847524, "uuid": "3cb25af6-15fb-470e-9cc3-d77188188e2c", "comment": "Malware payload (Mirai)", "value": "a2bfe18485bef37475a34f89f022c38931812dd2a4b16a9692bd0d3dbccc609e8410c7779f6b4d2abe98cc310ece292a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847524, "uuid": "bd7cf411-9e15-40f0-b990-48effc05fcf2", "value": "T14604D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847524, "uuid": "8ef10b9c-d837-4c22-8bdd-00c7241cdc87", "value": "3072:ueEksFM+wX5OiaVR8H3NaMZOTTMJxt9U+7fKbvE:ueEnO+wXWVWdaMATwJHy+uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765847524, "uuid": "e54af20d-10bd-41ba-b18f-673364737209", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765847524, "uuid": "efdc5258-ff35-4e4b-90a6-5a5b1f331b4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847524, "uuid": "7070d9d7-b31d-4552-9041-bae283f73d79", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6498c1-da95-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765899605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899605, "uuid": "054c2dba-8868-4aaa-984a-422d9107146d", "comment": "Malware payload (RemcosRAT)", "value": "613032d4a0d89eb3a2311d89293a551d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899605, "uuid": "d04689c8-2d5a-4810-818e-f47a650afcb4", "comment": "Malware payload (RemcosRAT)", "value": "525c960c219b8c6c7108c1b30d9f2f6e25a43741932952036816b4dfd5fd3c80", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899605, "uuid": "9a7e3e54-ee63-41a5-92f1-080aee6fd256", "comment": "Malware payload (RemcosRAT)", "value": "bb367cb49f527446ec0a2990addaf526fbcd117b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899605, "uuid": "9bf34835-d2b2-4d22-9160-2cc55c356527", "comment": "Malware payload (RemcosRAT)", "value": "3283ce87c9ad9192a6645b180f65c4f04034c8a3fbaf6cb9bbf06fe2566fb48df0c78e1bbad0fc00d84552910e1704df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899605, "uuid": "2a8b20d4-05ee-4218-8d8b-07fdef6020f5", "value": "T18436E754A7F5219CC6BAC826F52E35C0AE053E6FA0E50C6BB53CB5AF306369D6630C35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899605, "uuid": "54af697f-11a2-4799-8dde-cd03ba62e1ba", "value": "98304:rAnoeI7sOBKOwTqL+xTBEllSipVwIiDC7hkAIxsMeJib:rAot75BKOwTWwFSlSipVwtDC7hnRMeJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765899605, "uuid": "1b614a20-7e5d-41a2-a0a0-97a480720aef", "value": 5165433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765899605, "uuid": "60ea90db-4829-4908-949f-26b4b8f3ae42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899605, "uuid": "bba582b1-a99a-41f7-a075-005f2f4f5e03", "value": "ZECH_GROUP_SP_PROJECT_ RFQ_SPECIFICATIONS_65438.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06327ac-da1a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765846834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846834, "uuid": "586ddf2a-2bfe-4f6d-8a8f-f4dd82b532ae", "comment": "Malware payload (Mirai)", "value": "13788d22e3de45715090a5e0acaf47dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846834, "uuid": "ceae0fbc-8338-4df6-92fc-4c43775c1df0", "comment": "Malware payload (Mirai)", "value": "52754b83f569350e304f1615676a325c5220ad2be5af6baafe0a54eb16fb7529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846834, "uuid": "17673aad-4883-42d8-b782-7da98c7839ce", "comment": "Malware payload (Mirai)", "value": "a72417eb969fc7ff69468e103d6aeb4cf41d2ad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846834, "uuid": "9cb2cbee-2f68-4c7e-9a23-da86c500b61c", "comment": "Malware payload (Mirai)", "value": "79c8702d51ede4d9177ca51c1aecfc0e1f8dba5aac60b3e0444f7fdf6141d08c0c2e86da4c58de6d96768e9ad1920449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846834, "uuid": "24aa2351-2866-4151-8b88-6e5444c25cd2", "value": "T1E4C34C17E9C080FDC8EAD1748FEAE136D973B46D1278711E27D8AA362E59E305F2D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846834, "uuid": "36be3d86-dcee-44bc-9184-a165f3d4d178", "value": "1536:ggSgBM7LQzcSRen1tLAD1rr1EczCXurkjKXfXtDoXZUEPr343Ix:gBUCQzVRYk1rr1XCXMkCF+ZUErfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846834, "uuid": "df09499b-4c2f-4830-b9a1-d21263c85114", "value": 122520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846834, "uuid": "21195b4c-0bce-4670-8f4f-a9e62fe55c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846834, "uuid": "fd9eb9a8-368d-46c4-a8af-15748f5fc067", "value": "nuklear.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ab9619-da6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765881254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881254, "uuid": "27133eca-5d0e-4da0-b17a-6804a052d24a", "comment": "Malware payload (Mirai)", "value": "e5d3ad0585fdeeeb85e0e1747fe7d8f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881254, "uuid": "c3b5dfcf-4b21-47bc-ac9e-0d87fe5763f4", "comment": "Malware payload (Mirai)", "value": "534d2739f5c9aad73184c9938be7605974791d5a71069867c3782206b6b03d20", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881254, "uuid": "f8ab1fb5-1a7e-40ca-a3ac-caf73cc99b25", "comment": "Malware payload (Mirai)", "value": "afc98063a1258db0af4c97a61b28690760435617", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881254, "uuid": "b8794fa6-36c5-48eb-8934-3c48738a0c3e", "comment": "Malware payload (Mirai)", "value": "b1f508a08c833175cf57dd395b45a3569cc17eb62bdb958f4f2fcd390b6967cf4556ec018b4dc18b10e8733c579a0f8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881254, "uuid": "3c28001b-20e1-4646-9690-0470d4ac0357", "value": "T1A14182D542E510B238B39D6671BA0A9A31809BEBD8C9DECCD8D8B8BD41DDE4CE540773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881254, "uuid": "1b788265-745a-4c17-975d-3df9a2133ba6", "value": "24:vKeDesQsK1D1/hBsKWNRWupUeJKgPKnvfsKRyKXIKMtK6cvcKe4de4JM4T:v56s1QsdCstQspZNJ5dP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881254, "uuid": "586a70fa-29a9-430f-b271-400c93830d51", "value": 1918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881254, "uuid": "c6f77de4-c242-4b18-a8d4-b91a119c60ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881254, "uuid": "0438b073-0836-4173-b579-a3b06f1452c4", "value": "sensi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a95893-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765895799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895799, "uuid": "078c5c33-d1e9-45d5-a8ab-6e112a352b03", "comment": "Malware payload (AgentTesla)", "value": "8f10fd98a9f38eb717b8e01d6f17a1d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895799, "uuid": "e506360b-b872-4b13-8cbd-3dc68b0d0181", "comment": "Malware payload (AgentTesla)", "value": "534e2b761965f7e6f553eedad27662748d7a27def80da68aeeec8c193af488e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895799, "uuid": "a70d7b6b-ecb3-43d3-b026-92e5035df921", "comment": "Malware payload (AgentTesla)", "value": "f50c3e63dd941c09e829b77ddd54afda4341bcbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895799, "uuid": "ed381636-03a0-414c-bc7d-2766473f47be", "comment": "Malware payload (AgentTesla)", "value": "8887feffb5c0d481c6a44d460dc4663649ff29e3bdb9a79b9fc949c982e3b950f2f4b87761de1a88a523c5cb56e2690d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895799, "uuid": "3d6f8b21-6ef0-4828-a2a8-4a9917b3d69a", "value": "T1E7D334C437E2F821E26732723A3B95ABE23D5C41718C48D9F1957C98F86C619F7B6488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895799, "uuid": "d7dec7ab-ee63-4f18-af0a-879445331700", "value": "3072:aCPz5ey5r2Q3I2zHr+fBfywPV3/nXfdv:VPz5V6Q3Lapfz93/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895799, "uuid": "0e7744ad-3813-4c48-843e-045c9f5d57b9", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895799, "uuid": "6fc5bd50-3e22-4ce1-9133-4c90bad0f7dd", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895799, "uuid": "c9b11af6-0719-4075-b74a-6cb4e64736db", "value": "Past due Invoice.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b381bb4d-da9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765903989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903989, "uuid": "cde733ae-3553-4d95-b10a-53b278c32695", "comment": "Malware payload", "value": "7991c59c991765c750cbc59ba09e24ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan.Tedy", "colour": "#6E9002", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903989, "uuid": "0a9084ea-b3b8-487d-8ac9-0fb992157a63", "comment": "Malware payload", "value": "5403ddd6bcf740df0500709101ec06f8af432724c0d7bb49e0bd3119fa29d644", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan.Tedy", "colour": "#6E9002", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903989, "uuid": "7f08bf01-7561-4cab-9262-3151df0c167e", "comment": "Malware payload", "value": "e5feaeea16c6afa74f43a74937514c7aee9895f3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan.Tedy", "colour": "#6E9002", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903989, "uuid": "4ab59a3e-84e5-4f27-af29-0d0695e1c6b0", "comment": "Malware payload", "value": "d75be1076a11f2a4352cac976669b0a54100037e93707e28db169ea5036fa25cc54388d7fbdd9453c34ce8638fc1749a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan.Tedy", "colour": "#6E9002", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903989, "uuid": "bd4a2120-1c58-4e6e-9811-d667f590144e", "value": "T1F026333FBAE40F65C9AAAD71C1F65A214BF2DA43623BC768275550BB1C01BAC4DC63D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903989, "uuid": "11d59c0c-6443-4309-b1db-bf6e30ece120", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903989, "uuid": "70e30d5a-8102-443d-993e-8b140b6c2723", "value": "98304:MMuisHB+RXmrGYz7vY6PkpyWV2ZPGxPlGUxGSULpgngmK5:7ubKYz06PktV6P1hGna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765903989, "uuid": "617079b5-6584-4216-9458-037603821548", "value": 4725760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765903989, "uuid": "1f9448f4-4e6c-4a1c-b61c-6d719f998c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903989, "uuid": "dbb75b69-4afb-4d84-9079-3fd8c3631ce8", "value": "i.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78645bce-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765852780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852780, "uuid": "73383a2e-8b6e-43d8-b47e-9333d784874a", "comment": "Malware payload (Gafgyt)", "value": "bdd922e15bfec833738986694354a654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852780, "uuid": "9e808ef3-5d78-403b-9622-998d4d8d9f53", "comment": "Malware payload (Gafgyt)", "value": "54221e7b2463306f808b7e973b54b18a8caa6f019e55c284ea841668816a9b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852780, "uuid": "f3e30af7-d3b7-4b75-9f3f-de2508162ae9", "comment": "Malware payload (Gafgyt)", "value": "8f7b1352837d637b7ca00f8c2f3d99dd43f5d9fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852780, "uuid": "6e552f6e-a873-4ab0-95c5-2ab14f2c8747", "comment": "Malware payload (Gafgyt)", "value": "84627af133a00f07ab125ef40b41f4f90ead1a66e15b5626c7a61a191868f0fcf3ee24c297bff88f38cf46eea9d524db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852780, "uuid": "da78e034-487d-4445-a233-ddee2186d48c", "value": "T1E5B3192B7B170F23C0CA107116E31732AAB5D79534B99397AAD03DAC6F17AC43816BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852780, "uuid": "c4dbd355-75e4-4286-a40b-799e798e2e1b", "value": "1536:S+yS09vNUzhPtyN/E5ut6lt4S/bUx9GOcmX2FM/PUj8fEYX:iFN6hPENM7lt4SuvcmX2FM/PY8fEYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852780, "uuid": "1fac1603-ca8a-436b-8ae6-aa23d6c6f873", "value": 108015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852780, "uuid": "1b39497d-c716-4df9-b390-269840182fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852780, "uuid": "4d3e21b1-9d25-4b6b-aa44-ef15339dc0b3", "value": "Fantazy.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8720b05-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765896374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896374, "uuid": "6bdc2c75-8d89-4667-b656-f75e2800e05f", "comment": "Malware payload (XWorm)", "value": "6ca8fe997011bfcafa24a005fc4ba49b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896374, "uuid": "1f374575-c288-4158-a2cc-acaf372dfbd8", "comment": "Malware payload (XWorm)", "value": "548d63611e2f34af4a92577e2426a93a9b451159f35bd13f7b19ff59a01471f2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896374, "uuid": "dfb8f58c-1268-4061-9ae2-8471d4ecbd82", "comment": "Malware payload (XWorm)", "value": "79d3804cb4ec7587f723e6f363ff5de8f7fbeb3e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896374, "uuid": "9afc3f2a-6afa-4ed0-bd28-6c9d332b702f", "comment": "Malware payload (XWorm)", "value": "1f22733759ea7ee5619e59286f89c7777620759e229dbee1dae831e2bf5c1b451218a7c29fc0deb5dfac00c23c2032ff", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896374, "uuid": "1ab8171a-07fe-4840-9def-1f30d5a0545a", "value": "T108C4DF19195BE6D5C1F640346B4CF95DA182433BE2775ED83EB28BC48A04BACDB0FDA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896374, "uuid": "143c26d4-4a7e-4767-800d-a4a045f96495", "value": "1536:Iifo060jI+FUagxuCJZ71ukAqulGfojSc+4XNYd1auhZnoDtC:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896374, "uuid": "eea11551-a8bf-4539-ba8c-940ae99d5943", "value": 574968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896374, "uuid": "469b885b-305c-4a66-830a-0033e6f92547", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896374, "uuid": "3e7e5d42-6be5-44e7-a20a-f8db622b770e", "value": "lpo 17889.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d030768c-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879556, "uuid": "1b4fca26-702a-41ea-a806-20e1d010216e", "comment": "Malware payload (Rhadamanthys)", "value": "a9b9102ee2bd4778b35bb68118e3c637", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879556, "uuid": "609de5ae-5b25-4621-a080-52b60c9f855d", "comment": "Malware payload (Rhadamanthys)", "value": "54f721c836bc2172d5dbca074711aa7f680c979d6968b45af2b63aede728a7bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879556, "uuid": "ecd6024f-b8dc-4d95-9ad3-9e3d81a147f1", "comment": "Malware payload (Rhadamanthys)", "value": "afaae489ea8ae3f749dbe09e07971d15fc331e69", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879556, "uuid": "3152f96e-599a-48c9-be85-c0146d148158", "comment": "Malware payload (Rhadamanthys)", "value": "4ee2d98e385a418d962e7d799d6d9d28fc33764a9095b9eca1306144e6718aa5416370f2e0b0edc9f4430f02e8fc3de1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879556, "uuid": "f2ede812-4ab3-445a-943d-00f1652c3b80", "value": "T107A34CC0ED70F7E8470BD4BE2D41BEF1844B8A6F215890EAEB2BF71364152A666510FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879556, "uuid": "5bcb277f-4dff-4e8d-8f9e-70957ee027b4", "value": "3072:GDB7b0nVrrzMFmKkwfr1R6Cdy8i6BkQWkp:0uVfzMFmJwD1R6Cd13Wkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879556, "uuid": "c1930d3a-2e0f-4efb-a8d9-184914bdbbf3", "value": 99464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879556, "uuid": "565a0a57-ad0d-4b5c-8964-e7b36d38786b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879556, "uuid": "1f565e8d-351f-4823-b3ea-722aa5ff91d4", "value": "invoice-1637482117.pdf (77).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef232f0-da8a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765894855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894855, "uuid": "2661c4b9-9edb-4880-9914-c0612d05062f", "comment": "Malware payload (Mirai)", "value": "53b2b57e51421896bfec96b25f6e33cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894855, "uuid": "e4944138-9887-4409-8ee5-894ec0a17312", "comment": "Malware payload (Mirai)", "value": "55dcab8ae03fdc34cf4ce61d6b6a6e912b75bbe0e49ffbda4f8e982dde48174b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894855, "uuid": "20b6906d-9ed4-4bed-8224-57df966889e8", "comment": "Malware payload (Mirai)", "value": "240eb8f66e63bb921252a3d8d88b4830a9afea3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894855, "uuid": "ea9b7783-d025-4cd8-bcc0-03fba5698a73", "comment": "Malware payload (Mirai)", "value": "802c5f81c297d610f2b5fe9ac0eb25b6ccd01a32b05668b782f9adc5e78b966b48f685b1842b392a723ebba2360fd0bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894855, "uuid": "c5952772-d20d-4540-a018-cb09b55fd520", "value": "T1C9B3B45E9E21AF6DF2AC53B483BB4F299DB517E32BE0C581D22CD9105D70319A02FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894855, "uuid": "ea66c988-30a9-4ea6-b860-2d3f399bcb52", "value": "3072:tFjKwTk9s4cmtOt3CgBerp95L6poSujrdMd2pqYKFB5yFCiUg+u6Wkb9+VJ/KeJR:tRKwTktvbhQfYPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765894855, "uuid": "6da880c5-6cbf-4cb2-b480-a00ba975771b", "value": 118028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765894855, "uuid": "6f6ca21b-fd82-4a60-822e-1ce86d2b555f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894855, "uuid": "aaa2d336-c8aa-4014-b0c8-5d6660da63eb", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2805ec-dad4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765926495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926495, "uuid": "ee6733f6-73e9-4d80-8b86-e4859521fa28", "comment": "Malware payload", "value": "3305412b6331f9f9c6672f5e75c43b32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926495, "uuid": "44f99831-7ab3-418b-8b98-ab952163c0a9", "comment": "Malware payload", "value": "569b29396923ca0079e90b2a96470bebb619f6cff08440bc370cb59a656d567e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926495, "uuid": "8ae49eba-7253-4cf2-a49b-ff70f16a67bd", "comment": "Malware payload", "value": "49ec7763d3fca463763db3e754a93a854f3c999e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926495, "uuid": "845217a5-2cc8-46b7-b9f5-051e430e5040", "comment": "Malware payload", "value": "574e5bf66094e24c749fb27bcbaaaf9161923041abb895a38eae9ec7abf0ac96929b083ae862aa65ce6790ec57b7c227", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926495, "uuid": "8f0a6530-3e9d-477b-a0c6-f2bb18175671", "value": "T14EA3F815BD41EA16C6C066B7FFCE43AC3B164398D1FE7607A8289765B7CB8220E3D845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926495, "uuid": "33f26cad-47cc-49f1-b649-6f426f7bc8d8", "value": "1536:3oZ7dp/sRzzg90DUWSCP6NdLZFQRMlVBQHvU8nXhVR15:3o5dp0J8CtP6TLfQRKAPU8nXz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926495, "uuid": "1bbe5d2d-b1bc-487e-925d-5def0eb27bd4", "value": 101940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926495, "uuid": "ced47a36-8b09-41cf-8df0-45063150d9af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926495, "uuid": "c8a9fb12-c4b9-4822-b867-716b6829360e", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b4a7e6-dad7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927956, "uuid": "7cda9b92-4a73-4532-8e9f-686c2b89bbdf", "comment": "Malware payload (Mirai)", "value": "59c8ec992d674705306a850cb0047a8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927956, "uuid": "c47e1531-2816-42a9-83c2-b045892d8568", "comment": "Malware payload (Mirai)", "value": "571f98782879f1a372e0513b06870705e3943f91fdd9e30665b749643b7c7a5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927956, "uuid": "1b55e4da-4d24-40d1-8c97-3b78dd970ea3", "comment": "Malware payload (Mirai)", "value": "7253007ea1dca06119784867f3203bd7dfffd905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927956, "uuid": "2f925ffa-0b26-4e16-aab0-38d284cab81e", "comment": "Malware payload (Mirai)", "value": "d59bf18d08daffa1f3e8b6ea34addf4c99ac4287089d468846be63509f851e48b5baab107a14020721492a2fa469325d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927956, "uuid": "ac6e8334-98b3-412b-ad89-fd8f47799912", "value": "T177D308416C909B21C6D363BBFE1F128C331313A8D3DEB11B9D246B67779A1270E3A956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927956, "uuid": "2a14c9c2-d948-400f-a2e9-4aec1ce94fb2", "value": "3072:k1QnfpG3YYbl1thaqUx+unVR+XCi8zo8G5VnnX5:k1KfpoYYbl1uwu7+XF8M95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927956, "uuid": "f742c688-9785-4ab4-80f8-500771b4623b", "value": 132288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927956, "uuid": "f0a64ee7-1b3b-4bfe-ab93-72a8854db64f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927956, "uuid": "57581d55-4dfa-4bb5-99f8-caeada59fbbf", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638cfcb7-da6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765882809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882809, "uuid": "a43a9553-9c85-4fee-bea1-ba7cc0a9af29", "comment": "Malware payload", "value": "3b7db411aa3a32e44d13b8a017323396", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882809, "uuid": "908bd7cf-6272-442f-ad0b-e0486599776e", "comment": "Malware payload", "value": "573a9e274c0b84a65f893d64ba487190e9e80c01fc15d98777d953696047d866", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882809, "uuid": "a71bb4b9-e46c-4a5b-8129-06d88b409bd2", "comment": "Malware payload", "value": "7dec5edc2d9a623d9188e5f1502d7c322cd6c97f", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882809, "uuid": "4b0cb331-ea3d-4386-835f-de1a8ed1a4a0", "comment": "Malware payload", "value": "e0c91be2b880a730669652060203c6f1a93501544f711d5c34ff3de6ba2d5b07e500b4dee82df12b5dccae66accc1d51", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882809, "uuid": "aab644e5-dfed-4726-8cc8-224689811e79", "value": "T128F4127A928A4A65FEE113F62D56445CF8245D1BC2AD4D6372F4039F049FBB3C0AE932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882809, "uuid": "7eb14226-7a97-403d-a455-3fcb77504687", "value": "192:RTXH/bbMCbGeVmnu5u/wevKvQVf+LAqh0G5Y3:1eOe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765882809, "uuid": "d2eaab54-aa9e-4357-a5c5-1fdc18e4641b", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765882809, "uuid": "b851344a-5b09-4f00-a0a2-c5981ad00749", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882809, "uuid": "d14732e1-806a-419e-9c45-7b43d754c9d6", "value": "nREF_GBLEXP-_34___22_12_2025_pdf_____________________.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e5a5f7-da70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765883619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883619, "uuid": "1cc76fd4-a49b-4b56-909d-0406f3b998a0", "comment": "Malware payload", "value": "57ba3d1bfc8724668c52b98908bf159a", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883619, "uuid": "acce7966-617e-4c28-8865-2b0e2ee1c43d", "comment": "Malware payload", "value": "57896a20df2b2c1ec57c1f7fc5e65d4e7d7307b9799df2389a11a7540b22eb0c", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883619, "uuid": "9aa865fe-932a-4817-815d-652e856d65ab", "comment": "Malware payload", "value": "c3d275505e71ec5d8637fa43c78992471884f5c5", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883619, "uuid": "7b1c2075-3926-40cd-817b-12242c940ccd", "comment": "Malware payload", "value": "11d65d13cb80dcc06f3f0a9bb001ac380920ce2ef4f849940d7ebd6c93781ba4b474085b53be6054e1c1004d430f2a57", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883619, "uuid": "ba537690-b6ba-41ef-985e-613bb406082e", "value": "T19B1633B87D81844F9BE58F9BF42DEDB670A6BA44CBC06A56DC42D02D50C1265183FEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883619, "uuid": "b4bbfe56-1aac-4816-a49b-5b9df617bee7", "value": "98304:89e/dZzyHdMMcocaYVocJ/2nH9f8IaHEf1W3BsMXLS8HC1l:ugdZWH6dVv/2H18IiEfchLDCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883619, "uuid": "96b1dc30-0419-422c-af3c-16d1a7c4ccca", "value": 4414445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883619, "uuid": "cb8c1ea4-331c-4020-ad5c-6dd71fdd67fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883619, "uuid": "700604c8-e066-4273-91ff-a795976396ef", "value": "Tunneling Certification Course.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7145b4-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879794, "uuid": "8c44e28f-19b8-4934-b862-d1127f4301d2", "comment": "Malware payload (Rhadamanthys)", "value": "776a4bd0f414085b6e2d16ecd6b42b6b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879794, "uuid": "4bae1359-ebbe-4083-a04f-63776cf6881f", "comment": "Malware payload (Rhadamanthys)", "value": "57ccc1c2048a925c61f698c03f5520b0d79b28315f5d1bcd4e2b74064d4eb997", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879794, "uuid": "de30b324-f46d-4f4f-bda3-36740f3cbcfb", "comment": "Malware payload (Rhadamanthys)", "value": "aebd0d7892123276773ae1c48ad59647607fa8c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879794, "uuid": "26c16568-f137-4cb9-b0a8-7c7f0c733ab7", "comment": "Malware payload (Rhadamanthys)", "value": "d177654e7e5fca7dd813afc9b078ff1779eb3dd1a1a44df83aa767b80dfddc28b96c6bbb60d91ceb3a29eb1a0b1f1256", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879794, "uuid": "9a3cc822-3fcb-4fe9-ab16-c6612d96c4b2", "value": "T1A8A32A0A58875CF0585EC39D2F8EF6B2945B02AA8E53E485E20BFBB5460DD3FD4C1AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879794, "uuid": "07b4867e-3bce-4f42-8f4d-fce4b3359546", "value": "1536:GDB7eKg209tTeTPr7rKYpT9lTgPTiT7T7ABTYT1TBUT6BkQWJ+aY:GDB7b0qH7GcUT6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879794, "uuid": "7802a4f1-d954-4ba6-abca-73850f64e24c", "value": 98118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879794, "uuid": "5e565cd6-4e16-4262-b368-1996c2622d9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879794, "uuid": "02270e36-dd29-4f2c-bf0c-476a9a124604", "value": "invoice-1637482117.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716d5bbb-da82-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765891423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891423, "uuid": "c4186c21-5dd4-4a82-8595-1e8c99768aeb", "comment": "Malware payload (Mirai)", "value": "55d0d7d4369b614052f97c010530fd2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891423, "uuid": "f841fc66-d89a-4746-ad0b-5a9a95389d84", "comment": "Malware payload (Mirai)", "value": "57f5dc1e1dc5daaeaed3a7e5a9bb0cab6961941b451916f24213e0ee0515c051", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891423, "uuid": "0b3dcdf2-20d4-4143-ac5d-7dd38d760296", "comment": "Malware payload (Mirai)", "value": "19394d9dc701acb2fde3ff3ca25326a18219affc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891423, "uuid": "38ebf30f-be94-4792-a203-98f3737579ac", "comment": "Malware payload (Mirai)", "value": "e3eac26eedbae7ec3191be60edc3f6a6000ad33c228cdc82340512d36495eb04099db42c73868815abafd39d89106d1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891423, "uuid": "0c1f05ae-9208-4ef0-b668-7433b1bcc23e", "value": "T196A38C2284178EF8F1BC4BB8E5942538DB13695235CF3DBE59B490D4088BD9AF60F362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891423, "uuid": "af113b4a-7848-42c0-9fbc-5f2e3daefa12", "value": "1536:j/SJXvl+SaFMBx2AYTIq3XKLoWv2SBiytUaWbZCFjuoLQCaIV:jav874x2AYsq3XKLBvSaWbZchkC9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891423, "uuid": "98f75ef3-7c52-429b-9198-f18fe4cecc87", "value": 103772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891423, "uuid": "f4c05030-326f-41c2-9e1d-049beb39d02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891423, "uuid": "530cdb6e-a0de-4d5a-974d-78460d1c74ac", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2bce53-dad7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927757, "uuid": "be919e68-2ee6-4a32-b32f-61be92a0209e", "comment": "Malware payload (Mirai)", "value": "735f49318586ae03732880a1dd3450c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927757, "uuid": "c09747b1-afef-4f7f-a370-27c1b416ee44", "comment": "Malware payload (Mirai)", "value": "587b55841b6db3e4eddf7ea49e9f6d98d4b1bfe7845017b82f7a39bd407228f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927757, "uuid": "948cc1ca-ddb1-4b8c-8bd9-930799632b01", "comment": "Malware payload (Mirai)", "value": "96b3c9810eaf5b4be65e2e8c88d2385040465943", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927757, "uuid": "0a19450b-da61-441c-9801-41e7764d7536", "comment": "Malware payload (Mirai)", "value": "f269f460c40c0b37ee0635ca7e50f8dc89d643c5e930520a0bd6b106c1e4f9c242b0961f2c75112077657521e4dfe9c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927757, "uuid": "69744088-067e-4890-8fab-54c5442316d1", "value": "T1E5A3F715BC40EA36D6C066BBFF8F429C371A5388D2EE7507AD286F55778F0120E39865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927757, "uuid": "bc4222ec-968c-4166-8627-f14c30ab5bec", "value": "1536:SAIS+zh4LzzV39o7n3RI5kdwBJdueocMFg7Xmur+v08nXYVR15:SAX+zh4XZSVIFJduebMWnE08nX25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927757, "uuid": "361d609f-c233-475e-94be-e6f286055dcc", "value": 101820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927757, "uuid": "71f903d2-5e83-4a14-9f48-b00017795ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927757, "uuid": "19aeb992-0a51-4b1d-9c68-c0a032186d1c", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4457186-dab8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765914728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914728, "uuid": "c950b58f-1752-458f-923a-87bb0d92a586", "comment": "Malware payload (Mirai)", "value": "bc266979b2d5b62744c93679fa40f8d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914728, "uuid": "f2813726-528e-4128-a04f-939f6c9661f4", "comment": "Malware payload (Mirai)", "value": "596cab71b18097a2d5d1ba6ac378813582a058f2864978800a63164ea218f912", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914728, "uuid": "0969dd31-a1a1-4842-95f6-ce34362fd4e7", "comment": "Malware payload (Mirai)", "value": "b6828c9f1c4ade63a1b1fcfbb60b3d304aec7841", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914728, "uuid": "4c54fc81-08f9-46d8-a6d5-395d269e1258", "comment": "Malware payload (Mirai)", "value": "34ad4eed178f6658d52555cb4544924e593a30d825bd6b74b3ecfbb43e4b4614eb7d3e4b5c7c6069ab6587c9d28b2fb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914728, "uuid": "d90dafe4-4ff6-4cad-9ff1-fbfc9baec520", "value": "T1FED3E7481BA14EBBE4AFCD7741A84B4918CC554732A93BB179B4E528F70B14F0AE3C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914728, "uuid": "7b69d058-841a-4235-a5fc-eecbef239295", "value": "1536:x6im/6PWBT9d0S9pUPC22aK69fpXZ9l7rks4uCdCbpfEQXtOLtPTe8nXhVR15zf:ciOrdRQvpMuCdwHUt68nXz5zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914728, "uuid": "d70025df-d2fa-4c53-b857-3f8c2ee09046", "value": 135088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914728, "uuid": "4ab882ba-9edb-41a8-afd3-211de53aa8c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914728, "uuid": "ec9824cb-6e97-49db-b3ab-2be3dd13a856", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add4806c-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879498, "uuid": "e064cb9a-6f0c-4659-b66e-a06217b882bc", "comment": "Malware payload (Rhadamanthys)", "value": "c69e33b632caa45b6bc9690d274cad17", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879498, "uuid": "75a447f2-8f3b-4a69-9c0f-0218c6d4ab80", "comment": "Malware payload (Rhadamanthys)", "value": "59ca6899f679cfa38964bb6c1ffd37959068ef40361cb392bb76e0c308f9b441", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879498, "uuid": "18647bf4-7e5b-404e-8305-0516c320bafe", "comment": "Malware payload (Rhadamanthys)", "value": "b03b808c0d52eb797c689f3f540ef230fb862cd7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879498, "uuid": "92b441fc-684f-4bee-94aa-cd69c003f754", "comment": "Malware payload (Rhadamanthys)", "value": "71f62e5d5a62e2ee91a4813b2b75526348611039f5ba62076b5d517d1f3c298505ac22e420f75244828581df69ef6069", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879498, "uuid": "0efee140-f306-428f-ab80-9c247756b123", "value": "T165A32AC2EC17BCBD298F3A383D810AB7D45DF9833F63A0B1A145B670A908795B1564DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879498, "uuid": "8c128c85-7cbc-4513-9423-0f3abe8d4452", "value": "1536:GDB7eKg20LVruhUuxho+nb9z69KofmtKvzi/UpdeJY5XJCLJ93jLO4RVrpXD9rGu:GDB7b06vLWNUM6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879498, "uuid": "aab7bb9a-4624-4edd-8f68-99e860829f12", "value": 101469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879498, "uuid": "417d03c1-77d3-4854-b4a2-8683528663a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879498, "uuid": "85f38f9e-fbf8-4402-9b0f-1ef9ca684908", "value": "invoice-1637482117.pdf (87).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93c379d-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879544, "uuid": "5a7f3e91-f13c-43fe-a067-096eead08e61", "comment": "Malware payload (Rhadamanthys)", "value": "8e56f69d0d8409c076f8706404a557db", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879544, "uuid": "b66ab5b1-c42c-4ec9-bd37-01b0d3910c75", "comment": "Malware payload (Rhadamanthys)", "value": "5a0fbadbfebe0959cb0bcfcac34a443d305ae93eca9414ea6799c9a5cbabdb34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879544, "uuid": "e6ca93e1-df8c-4851-8b7e-8c94a1513bea", "comment": "Malware payload (Rhadamanthys)", "value": "5e80c9816f5ae01acccdfc6b48fc5bf25e2b64a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879544, "uuid": "140450e9-1236-40f3-b581-55e839b90897", "comment": "Malware payload (Rhadamanthys)", "value": "fd6fbec4fb38c84d558df6db28fed0b3ce8599e9781c48d7b2c57a59e3af48e64dbdc75355d60ea29e45ce5c39434445", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879544, "uuid": "0eb76775-7c74-49e7-a293-28995e924236", "value": "T12BA31B695F1B769D28C726291F8C2970FD8EDB0A2F1052E0C082F7133D4FA955EA99D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879544, "uuid": "2c560e92-9ca3-49f1-a129-a29bc8f4fca5", "value": "1536:GDB7eKg20gF7HkHYzTQJyFbc1181tVlEI5nkGYw/48nTloxm+xlyXwd/SArzMsZ3:GDB7b0n/byFsU6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879544, "uuid": "2a7d249d-de88-4a63-a68d-673b310ecc3f", "value": 98108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879544, "uuid": "d37c2fb5-3848-4934-bca5-87443f836f5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879544, "uuid": "73b66d91-9e69-4f72-a0ba-ecf38a4b026c", "value": "invoice-1637482117.pdf (78).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac014ae-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765880003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880003, "uuid": "5c6ac593-4266-4bd5-9860-fc8817a72768", "comment": "Malware payload (Rhadamanthys)", "value": "918078429142a7afb4669f2f4e857055", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880003, "uuid": "c20e1038-c7af-436c-a42e-d5f6d30751d6", "comment": "Malware payload (Rhadamanthys)", "value": "5a1449fc68304e2119501fccde1b292378494b04113124a2559bb02b2e0d689d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880003, "uuid": "9b2dff3f-fda9-475e-93a1-dc6456339a86", "comment": "Malware payload (Rhadamanthys)", "value": "c4aaf4a6e41c2a5f8f004bf5220d6e0d0721abe4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880003, "uuid": "71f67ebe-8eaa-4b5d-aadf-ab5c27268e2b", "comment": "Malware payload (Rhadamanthys)", "value": "812df8fb727c231ebe9235ff1661486551265494c71953e8e4a0294deec8335bb0b00cb95f8b21617bf390e38ea447e9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880003, "uuid": "9cb6a147-e3aa-4279-9dd9-05c73f6d132b", "value": "T1FBA3F8592962FFC533E21DB84AAC06F0469E3DB580A53449035AF7F9D2273976AE0CC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880003, "uuid": "c05b4111-fba4-42b1-9b9e-36139c2c2751", "value": "768:GDhd0i7J4sYKgY/CMNfWdeXvrXI8rGyIMHE9Y4HYAT12jSLAuAAroQW+FF+Ec+0G:GDB7eKg20svrvrGyIZoATwj6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880003, "uuid": "789f4766-b087-4c13-a953-00c69601fe89", "value": 100747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880003, "uuid": "cc36da84-1a1e-4fbf-97e4-fcad629e1e0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880003, "uuid": "82e68bf5-8032-47ec-b0e8-412d81c6f333", "value": "invoice-1637482117.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15daec31-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895994, "uuid": "a9c09304-562c-4a33-8435-50fde9c11a2f", "comment": "Malware payload", "value": "db20638310045ca586b6607bb8da18c0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895994, "uuid": "40d628c9-1d9a-43a5-8a6b-76b067b6c21c", "comment": "Malware payload", "value": "5a23a312b1c1bcd3455d2720be2c12353d809005cb8e65f7f4a51f7f9afd04f9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895994, "uuid": "47dab7ac-24bd-48bf-9362-8ec0a1b5ea48", "comment": "Malware payload", "value": "56536b4387b546acf63fcc0581ec417cbb2d581c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895994, "uuid": "1380257f-c95d-46ca-9fb3-218ffc86b6a0", "comment": "Malware payload", "value": "636cd6c5fde8be291041bb8fff1892ba092ebae23959e38c2244ca5b3de0cadbab99431c79cf71935f129c31512cdb36", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895994, "uuid": "ad009ea6-e796-478f-abc9-900e8d0330e4", "value": "T1CB5178101EE61258F2778B3257FAB3668877F864C93846AD004D86441733640E0F6F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895994, "uuid": "472de90f-8a1b-4022-8b83-e1e71fe44fa3", "value": "48:8y5a/+2V9AaKaj5CCp2azxsJmldJ9AaZ:8y5y+2vAaKajhp2aikBqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895994, "uuid": "11c2a594-d56e-4ecd-9e79-535518a4fa6c", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895994, "uuid": "1fd6bf6b-9b64-484d-a824-1204babee496", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895994, "uuid": "06da618b-e5c1-4922-9978-3167d78e7418", "value": "Quote-ID94.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41310abb-dab7-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765914105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914105, "uuid": "7f8b47bf-e576-4e41-b488-fd77ac8629c7", "comment": "Malware payload (Stealc)", "value": "2ff501bdac3ca65d28980a7c602530b2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914105, "uuid": "a687204d-08d2-40ce-89fb-01d12d446520", "comment": "Malware payload (Stealc)", "value": "5a3b45c0e42ff621b0289290c5883f459ad699f37c3f14164f841de66f0c6eb7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914105, "uuid": "c89e3bdc-6dfe-4961-b905-c20fd97b3ad3", "comment": "Malware payload (Stealc)", "value": "6d8a176ea7bb4344445c825337e94ab197d65285", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914105, "uuid": "c94fa509-652b-47fc-8b8d-9b692b1b82e1", "comment": "Malware payload (Stealc)", "value": "9ebf642532cc70112c0f1c3faf8872497876a1ea99d0f82b940a7810ddd2b5a055032fdc77f164fa817774b81c4ab694", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914105, "uuid": "6e36adeb-5f20-4f27-ad35-5e24f258cf47", "value": "T124A56A43BC9115B9D0AED2328A6A52527A30BC990F3163DB3A60F3FC2F767D45A75318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914105, "uuid": "d8d4103f-6699-4bdb-9caf-fb62f0c9b503", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914105, "uuid": "2dd5a2d3-28e8-4930-9c46-0ddb72fcdea9", "value": "49152:GnAU/GoNKI3Otrb/TcvO90d7HjmAFd4A64nsfJcyEe90C2VISHcoYg15Q6E/gD1D:mXT3OCCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914105, "uuid": "f72c7d35-e6dd-47cf-88e1-791f69f387a4", "value": 2221056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914105, "uuid": "6833cad3-2e44-46cc-971d-ed9e4f0705c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914105, "uuid": "eedd283b-cc49-4b96-9dac-f304ba12d466", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89806686-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873854, "uuid": "0fc7ffe4-8956-4d08-ad3c-a607225b5022", "comment": "Malware payload (Mirai)", "value": "75db504b2f5d81aabad5848fec926cb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873854, "uuid": "8e69991d-d6e3-41d0-ad15-b2764d707483", "comment": "Malware payload (Mirai)", "value": "5bc04134c9c0f1f752671b97e92e1ea2d6e8e90dd4be6176ef7e13a9137736d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873854, "uuid": "d992081b-ff88-4948-934a-0bd43aa27d94", "comment": "Malware payload (Mirai)", "value": "a55268148ef8761fee89f1f234402ee73a2a7c32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873854, "uuid": "01f2e587-3690-4c24-a416-538ad2a0cb5f", "comment": "Malware payload (Mirai)", "value": "35dec4f0ed796d15179f3daa69489f554dc472113510631cb6ce52cdfe430ff4ecbb73b26961e582ea1458f145500c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873854, "uuid": "62ff768e-a64c-4cfb-9fba-6692bfc840dc", "value": "T14D132842B2180443D5A31EB0353F07E0E7ABAE8121E4F389B60F9B4EC1B1E779546E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873854, "uuid": "7e30ed13-beb7-47b0-8d61-8f7bf785dd99", "value": "768:xz/trJUPVQUsmZFfHY0IcDP1UDdQ9vDche/Tanp+Lp7nl+ndxWt:bWmUsKlHY0rDyuvQhTn0d7nl+dxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873854, "uuid": "c642d236-2dc1-4270-a00b-7cb48bcce453", "value": 44200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873854, "uuid": "06ce62e4-4de0-49a5-979a-64485928316f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873854, "uuid": "7ea531a0-4c12-4aa8-8391-88a6219c4ea9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dcdc43-daaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910915, "uuid": "a5b3acff-ede9-4c5c-af61-921df801616a", "comment": "Malware payload (Mirai)", "value": "bee5f2f081ef2f297fe58fdcfc0f84d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910915, "uuid": "0e21d4ea-1c56-47fd-8a6c-9409f09fcec2", "comment": "Malware payload (Mirai)", "value": "5c311d56b4b2c8339dc43fc52ff614832a2845ac4ce7e93b9e7dad32e051b24a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910915, "uuid": "b69cf992-c25c-469f-a18f-903d0d57244d", "comment": "Malware payload (Mirai)", "value": "073072d356396e2b870d18d04c88014562fcf3cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910915, "uuid": "084a391c-8f6e-4992-b7fc-ddc20f498676", "comment": "Malware payload (Mirai)", "value": "09b8e53ea8f5aaca1dd2cbd7d135523f11de6f0ebe96d63462e94b75883f9c55eb575a7423ff8df7e16311c229756519", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910915, "uuid": "178273e7-4f93-4af5-a501-3b2696327b8b", "value": "T16DF3C5096B611FF7E85BCD7745E84B09188C598332A93B3579B8E904FA4B14F0AE3C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910915, "uuid": "aead269b-cb9c-45c9-bd37-5d251c3ac4e6", "value": "3072:xsXhH+dt8GVwmS87WiJC4YE5LK78nm5e:xsX47elGWAHp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910915, "uuid": "ed98096e-052f-4db4-8247-7394d042b3c0", "value": 159624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910915, "uuid": "3db4a584-b331-4525-81e3-3f58a1a0534d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910915, "uuid": "bbbc88ad-215a-4ce6-9340-fb6f75fb6721", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2176c9-da18-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765845943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845943, "uuid": "dc0a75f1-b45e-414d-b554-5dcb3d8a02c9", "comment": "Malware payload (Mirai)", "value": "91d3cc4e0766a14acbd23528c567d298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845943, "uuid": "5f9dbd14-b742-439a-b7a4-986b6feadc8e", "comment": "Malware payload (Mirai)", "value": "5cf94dc1f6ac8507d34046cce8d7b37d22aaf01f333c58e3cecafd2abac74566", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845943, "uuid": "7067b6c0-8630-4b71-bd80-96bb1e414477", "comment": "Malware payload (Mirai)", "value": "ad78752aecdd50b668af8ce738166155bdcdb63d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845943, "uuid": "dd2c1838-18fe-4855-a0f3-faefc003561a", "comment": "Malware payload (Mirai)", "value": "b04c5546561c8fa9f7cfc0147bae4a94b07cd166185cc80d0191e2387ac37b911fb2ff9ec805167ad8ea4127c7a3723b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845943, "uuid": "c45f8ed4-06c3-4e97-bb7f-a80e9f32cb9c", "value": "T198937D2A4E94ED6BE39E0DB7A5618A38C71223A025832F7571B480E5C1C3E5FF94F365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845943, "uuid": "85a4d39f-4ed9-4bce-8881-0643a253791e", "value": "1536:gVHEkzLwcJaBcDJoVCPzi4zCYYb5U5u5DjeFxCTPm5DCMbVRBVG:zILwEaaDJoVCPO2zYS5kDiFxuepCMpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845943, "uuid": "f509a612-1e04-47d8-a118-d6e3bdee3168", "value": 91308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845943, "uuid": "7a9d2c0a-4922-4ce4-a6a3-bf6cc5165027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845943, "uuid": "1bf33b66-a1af-4f22-8068-30ad6b8e2a24", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18659975-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926922, "uuid": "d2d7372f-8768-4c39-b5ea-981288eb0876", "comment": "Malware payload (Mirai)", "value": "07e496487af5f36060ece4258516be60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926922, "uuid": "1668259e-d827-486c-a982-3961c12b494c", "comment": "Malware payload (Mirai)", "value": "5d48ffe86cea3e61316ac82593cf2a454307d772474cf5e9211457296eb1fde2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926922, "uuid": "386f7b7d-3727-42e6-9eac-c94504621cbb", "comment": "Malware payload (Mirai)", "value": "8228e7f0f435cb904c4e24096a8d25823f49a1cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926922, "uuid": "aff818e0-430b-4577-a46e-eaf5e0d1bd79", "comment": "Malware payload (Mirai)", "value": "2dad065ab0d9ca2c034bdaa0d3291441e9f121c8a54287e669355127b789fa0c8da3c4c146ae9746fd0b10cd52607f00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926922, "uuid": "f9bd9bb8-9023-40b4-b524-722c29915cf7", "value": "T15EC32A96EE8BD4BEEC050171706697378B39FA3A015BDB8BDBBD99305810201865DBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926922, "uuid": "73b06cca-efa7-4370-b1cb-3fe74cdb76cb", "value": "3072:bgapI51wtf4Fr0YXP+FLk0AFbBky+oMXKzGhTjqu3ccimpXfJA8hzaGvuAvXhoKv:E35+4Fw+KJanMAnlpxro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926922, "uuid": "a235e32e-44e2-48f4-8ad0-3b2da4c580ae", "value": 119760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926922, "uuid": "975ce3fc-8cde-4c39-9f8f-1b606e5b9c48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926922, "uuid": "d074699b-291d-4dd5-8018-0fd204e6dd87", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77020c8-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765905391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905391, "uuid": "9d5e67c8-c221-441d-93de-f2c15333a869", "comment": "Malware payload", "value": "c71f4b0924d4f797047cce77ae43d786", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905391, "uuid": "60f35b40-5cb9-4ba9-88bf-a198e264f452", "comment": "Malware payload", "value": "5d4e77062cc576ce3f73e893550c2d83a895d506953dbe8ecebdf56224bf415f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905391, "uuid": "047618e6-fe29-468e-bb65-897eab7b2c6f", "comment": "Malware payload", "value": "1be97d696856aa0f35978291b62483bdd23e979e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905391, "uuid": "cebd7f1b-e04c-41cd-8f68-08db39b5ec99", "comment": "Malware payload", "value": "ec23e6463299f5f3526277571a642d3d1af6c9eaa5cb87fb4e0fdd5fc10faa4045e6124fdd4a0b5a196d62c1e0421bdc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905391, "uuid": "0dc0282f-d14e-417b-8d33-a744e6d85c62", "value": "T1EA854B606EC64BC0297C47D269E36468CBDA69BBB6CA3C59128D4515304BFE0F1F4CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905391, "uuid": "32570776-2278-4254-a2a4-c922cf31c716", "value": "3072:/u5dqRTdoAlkwu2Xbhl3owhmp0twnpVAXf09p9uWXdut7+RVpxRt3j3oKKCf0hIs:lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905391, "uuid": "9446e1dc-7a91-4f23-99b9-615829a5b0bc", "value": 1818880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905391, "uuid": "ccadd768-dbcb-4a97-bd34-f80694b50aa3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905391, "uuid": "38805a70-e983-459a-bad9-8c34175bb66d", "value": "UUVGeRgN3TzYYqzG.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d780d817-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879998, "uuid": "306206a1-3fe5-4ea4-89c9-4eb2519dba35", "comment": "Malware payload (Rhadamanthys)", "value": "d39c07f6df71ecda4f1b9899f6ee123d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879998, "uuid": "665709f5-cdea-4c60-936f-f589948174c9", "comment": "Malware payload (Rhadamanthys)", "value": "5d87eeb1941b564d032924ab8d994056ef1bb73012ea56f7c0d5ee9914dcae54", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879998, "uuid": "cec004e1-afc1-485f-81c5-92add9c3c401", "comment": "Malware payload (Rhadamanthys)", "value": "2cb98446664117e4af528b69436f24cf21b9a158", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879998, "uuid": "0bda02fa-8e06-4076-8b34-45ece40f4447", "comment": "Malware payload (Rhadamanthys)", "value": "d735b28d4b2c8d039816b7f60eae02dac5dcb3eda37a511d8fe5621f5e536bf0844ed2ba16059a83106b880c1c2b9f2e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879998, "uuid": "361c7c5f-e40d-4e76-85b4-4318870bf5b0", "value": "T1C493E9943DEA7CA8421BE7231FCA53A09D39DE508619C1E7542EB244D4E8F3E1AD4CDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879998, "uuid": "5a10898b-cc0a-4516-b208-601441d02e10", "value": "1536:GDB7eKg20SN1NuN/NtNvNaNRN3NtNHNlNrNoNYNLN4NzNHNsNUN6NyNaNXN7N5Nm:GDB7b0e/fSgEI6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879998, "uuid": "256565e0-50a4-4b69-bada-7b0663b54572", "value": 97433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879998, "uuid": "cf6c0522-d379-4ae2-8848-81be5b1937ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879998, "uuid": "af027048-95bc-4cf1-b4e8-c57dc245bf23", "value": "invoice-1637482117.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ac5e7d-dad4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926702, "uuid": "706d6917-f9ab-438c-8cb0-d4aab55a1ec6", "comment": "Malware payload (Mirai)", "value": "fdf921496ecd078c826cdf9db5655afe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926702, "uuid": "b6dbbb7c-34b9-4674-972d-5825043f8d31", "comment": "Malware payload (Mirai)", "value": "5e41613b235ac33fbb75b51da8a1d052506571047cc227d43faa81b921679427", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926702, "uuid": "eac526a5-6b79-4c5f-af87-de3f991e5fe5", "comment": "Malware payload (Mirai)", "value": "f988496fe4b354a91b422e34ef5257070b683352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926702, "uuid": "a463e499-9ff5-4037-9938-908b26ada18d", "comment": "Malware payload (Mirai)", "value": "fbfdcd22ac51ecbccfac19c493732e50755fdd9aaf2fd9c9f7d72c4761eeeead98ccaa1847308a5631a25c827e523594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926702, "uuid": "bf59b3bc-da12-481e-89ef-2b2a9da296ab", "value": "T19D83FB93B21C4743F0924BB59D6E77F4DFA87A61A1ACB68C261FA6090075C3284C5FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926702, "uuid": "2b47a4d9-480e-400a-a351-81bfde707337", "value": "1536:hIt14GNQ8ljfbasYlGfWWUTSvtZ8nF54HHHaFFwfps/Ra:h2GipM8QSvT8nF54HHHaFFwfps/Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926702, "uuid": "480fa85c-014b-466a-8ff9-20d38320ca90", "value": 88280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926702, "uuid": "8f5850ce-1630-433d-8801-8c02a4014387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926702, "uuid": "4b26ca90-b6fb-4175-9b08-254c895affcb", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb214a3f-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1765905290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905290, "uuid": "cbeda354-bf4c-40f2-8d5b-cfea34d6684c", "comment": "Malware payload (EternalRocks)", "value": "4f1034e8bf7d22e09c253992ec58106c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905290, "uuid": "25969920-7ca9-4e24-98f7-0fe4334a7158", "comment": "Malware payload (EternalRocks)", "value": "5ec8bd6667f86cc69d60f355bae70e54bc18658c2385958816763237d6a7ef48", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905290, "uuid": "0721ca02-db0f-439e-b2af-178289196c0b", "comment": "Malware payload (EternalRocks)", "value": "88219c2820e18f5a6a564a8777c0fce0fe90d415", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905290, "uuid": "f2a40d4f-dde2-4f7a-a2c5-68a008f118f1", "comment": "Malware payload (EternalRocks)", "value": "8216cea7126bf8c40a2d4b92047ffa20097622b0da6593201d11b5bb31f684c2d6db540731af019128d204d7416aea1e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905290, "uuid": "cda51623-5540-44e9-ae1e-053f3b10aab9", "value": "T18605EA03BECFDE6642D2DAA3E6E7D108FDA4949D552B7AC4B2DCC2855430E9407C8E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905290, "uuid": "678a4076-9dff-469e-a4dc-9e66510c6ee2", "value": "6144:FL4YH9YQCjYryWqGT9Gm73C0qN7X9qzVuh96LLdXSJz0LNG2XhWXeJ6g6YMLYsFi:p6QCUr3qBpX9eVuzIIz0LNGSOZ5LXb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905290, "uuid": "a82eb573-a71c-40b2-af66-599da47319d8", "value": 825547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905290, "uuid": "6aed625a-5400-4a48-a219-d4cfb10fbead", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905290, "uuid": "727e3c12-87f5-4864-a2b7-8b3d701121c2", "value": "por2nbixw7wm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d74c5de-da7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765888812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888812, "uuid": "b1d6005b-8368-49ea-9349-7782cd24f194", "comment": "Malware payload (Mirai)", "value": "013140fb87a7351797980d5050c4cc24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888812, "uuid": "8cb63e01-4d1b-4c87-bef6-6a6eacf34a07", "comment": "Malware payload (Mirai)", "value": "5ee8dd6bdc11a1eedc80a3a5df99a27edf3278d3908c2fdc15cfc0657bf55676", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888812, "uuid": "af2412df-b08b-4053-8265-8943913ad492", "comment": "Malware payload (Mirai)", "value": "489aa053c6b66ec65a9386c34c2deff588ef4acb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888812, "uuid": "4b35803c-7a43-4b9a-8087-48f8f408d556", "comment": "Malware payload (Mirai)", "value": "1561ab0247e8589d13c009021fccacd4ae39012b58c8a0cc85ea9159787e8c0f3cd0fe4ee10858f630b210360366ba5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888812, "uuid": "91bb097f-03c6-447d-8660-8d539ac19546", "value": "T182B3F654BC819B26C7D7327BFE5E329C332A9394D3DE7106AA242755B38B09A0F3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888812, "uuid": "5a63c13d-7868-4d41-8d78-f9784997e9bd", "value": "1536:QaV/2xCLuy7F+7vkwbJZUZ69IfzzsPwZ5mxHzfDCE1ei3/2GiovU8nTo5iP:QaVuEEZU4IZ4zfDCKei3qOU8n852", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888812, "uuid": "bfb34974-d072-4509-8801-d24ff31f830f", "value": 115904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888812, "uuid": "ede75e9a-0a33-49a8-a6a8-0934ee3765f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888812, "uuid": "d6136079-3bf0-4a7f-80d3-1f5846b0d9e2", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea8c20d-da75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886076, "uuid": "56983781-a7af-4e4c-ad52-b746153e4e1e", "comment": "Malware payload (Mirai)", "value": "eb738d6f891ef447b15e71762929affd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886076, "uuid": "2d82aa5f-1405-460c-a294-b4fe561395c9", "comment": "Malware payload (Mirai)", "value": "5f1590f983987c981f4e9dfce191bf51356531f6ff3a61ea39d347813d4788bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886076, "uuid": "37476ade-c06e-41b9-9188-1f893a196272", "comment": "Malware payload (Mirai)", "value": "dee8376f1714b890355960d55abd66ebe6539fa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886076, "uuid": "438715b3-b973-46f3-b75e-d5bbdbb41668", "comment": "Malware payload (Mirai)", "value": "5221ecae19680cd0c4e97973180958be8d417647ff966e5c454090ffef562102a8d3c84591d4297746b03fcb5680888d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886076, "uuid": "a7843eee-2214-4a88-94de-e21a66bc0deb", "value": "T14CC3D7956C418B25CAD323BBFF5F118C332213A8E3EEB1179D146B55778A2270E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886076, "uuid": "c71a1313-b952-4816-9745-2551c7fddabb", "value": "3072:sOh0T8pAZ7HSH4ZrO56JltIb3ao8WE5Vnr5l9vq:sOhO8ps7HSUOUbtIjadB5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886076, "uuid": "f224c855-bcfc-41df-a0e0-818bb7dcbe08", "value": 128884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886076, "uuid": "5cdb2816-94ea-4c56-ba97-77747228cf20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886076, "uuid": "78f3af46-1da3-45ae-ba2d-9a417b6023fb", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e935de7c-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (WallStealer)", "timestamp": 1765895919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895919, "uuid": "630f9763-eff5-4f58-a8e3-277a33b3871b", "comment": "Malware payload (WallStealer)", "value": "2190a5660391ef96bd50445b19ab2652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895919, "uuid": "d868e37e-7e61-40f8-8b7f-f7af14557df2", "comment": "Malware payload (WallStealer)", "value": "5f3b4c4ab857bf1bd881d7eb20cd5b1f27f3ca8f9aa80853bcb6024b6c8e2e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895919, "uuid": "2fe3f7e4-019d-4225-a20a-56b589de2f56", "comment": "Malware payload (WallStealer)", "value": "0aead80efcc8adee4ee8bb3da635e4d126b36517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895919, "uuid": "72927d26-f725-4e35-b059-cdfb247bd38e", "comment": "Malware payload (WallStealer)", "value": "bc33375cca2427df6b0d7b9374ec6a4a524ed673fffa625abb67eea467ad3bdf4945c02759abb71d41de68e24524289d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895919, "uuid": "714095da-9911-45ad-8f55-ced598068847", "value": "T130653B17E6A344ECC12FD1348767E772BA70B82945347E2E1B98DB322F21E509B6E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895919, "uuid": "b9945ffc-0cfd-4c93-ad26-64c11dadba60", "value": "8cf6554c02cd9b49ac0cbd21e031362c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895919, "uuid": "39859756-879e-4364-bddf-0ecd49b2000a", "value": "24576:hs/amsDBlv6PSHlc4ksu8XmXAxmfa2HZq0M4HGTfOx9MhV22:hCaPlSPSFbksu8Xmwxmfa25q1/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895919, "uuid": "b84358ad-a3c2-47d4-b3f0-8b651aadf640", "value": 1521152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895919, "uuid": "fbc22fbd-d165-461d-b259-7ff7863a7af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895919, "uuid": "85735f68-a8c0-4b73-876d-282c3e867080", "value": "SystemInfo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ac7bcb-da75-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765885665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885665, "uuid": "0783207d-be79-48eb-9e0c-f0fb6f3d52c6", "comment": "Malware payload", "value": "1d08d2e875db1d091b10931afdb8e486", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885665, "uuid": "97d80dba-58a4-47a5-8afc-94f392213eba", "comment": "Malware payload", "value": "5f624f15f2d0031e2251d0f808f1590a9f355c7bd2d1755c9b7b920fe6277ada", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885665, "uuid": "b07c22fc-1a63-485f-8dfa-c651c4ff39f2", "comment": "Malware payload", "value": "b5b03414de4962426d37619eac10324a1511139f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885665, "uuid": "7abf9334-e9ea-4c97-a1b4-97a899d0ea3e", "comment": "Malware payload", "value": "906154050ccedac1a61ec0625b55fe262a4f94f624d74ce7c2b9a94312219ad2709e31a6e12a9d001381401daa533373", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885665, "uuid": "377758e6-3cad-405e-9877-5596530541bc", "value": "T152838D2660068EFBD28C8D3570A19838D72351D319572D7FA9B18BB300C7DA6FD2B366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885665, "uuid": "9cafb48b-cf0c-4f41-83a3-23cd82d3efb7", "value": "1536:2BSJeVnkiqYMQTxH+uxxcbTIF6e3k2+U8yijCeQCUV:2BVk+fxeuxxcbTIF9kO8yijACUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885665, "uuid": "ee99b8df-bf2a-46b8-b7fb-5015c6696816", "value": 82808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885665, "uuid": "abcd850e-21d0-4378-b24f-429aa6dfef8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885665, "uuid": "18a4a5a2-f9ff-4baa-bf44-1981aa5734d7", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a81ff86-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765927140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927140, "uuid": "05d35ca9-a1cf-44c6-96e6-b69ff0b0a7ff", "comment": "Malware payload", "value": "a44bb23c91592a57efbe050570e27a73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927140, "uuid": "0670b81a-26e3-4a83-a654-1a552a0675f2", "comment": "Malware payload", "value": "5fd414d9426e904984dd47535b2ddb4b7ddb5aa32e56871aadb058e41dae35df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927140, "uuid": "371c9aa4-ec35-4181-8b73-f59fe44a93c8", "comment": "Malware payload", "value": "c9d73ef849a095ee20ace76c8bf81af51d19d7db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927140, "uuid": "e06002f7-0c08-4b07-9339-207745d53fbf", "comment": "Malware payload", "value": "8da962d207fe27eea8ede1a1ea74a8345cc44f588be6a562c614fd8fb1983a95585ac55c37c3bbe6cb5600f1fe6c1f44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927140, "uuid": "52b40613-edcd-4c05-83e4-bcd4cda62dd1", "value": "T10FB31845BC419A66C6D7267BFFBE12EC33266394D3DEB007E8246B54B38B01A0E3E545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927140, "uuid": "c8e99f08-bac9-429b-8eff-333a59eb3398", "value": "3072:HaTh2PN/+0srzPgaeQnm2ghINF8n125Ixx:HasMbrJZghKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927140, "uuid": "6c094ae8-fc54-43c7-b854-670ef96a7bf9", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927140, "uuid": "3f92c7d5-a147-456a-86cf-83da4054b122", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927140, "uuid": "037e62c7-59cd-4dc1-a04b-1e094b1fd547", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44c3852-da7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765888153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888153, "uuid": "92e82b79-4bbb-4f2f-a3b8-996ac78b060f", "comment": "Malware payload (Mirai)", "value": "db579bdbf4d0f0140a6800432b1c2889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888153, "uuid": "0285bb13-e3f6-4e56-9d32-2378f648ea4b", "comment": "Malware payload (Mirai)", "value": "5fd8ea484ff2575f33b9a68ca789ad16f63e37462df64eeb2b84fa6e34fb5c99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888153, "uuid": "937a6336-c03c-4eb1-a596-891dc127a552", "comment": "Malware payload (Mirai)", "value": "8429f6165a835043b8bcfc34fb5632efc05d6857", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888153, "uuid": "4188bc1b-272b-46fd-90e1-fe7ce292aefb", "comment": "Malware payload (Mirai)", "value": "ead075aba448f6a1bb6854308a57d080dbb41da49e354969763be3506ecf89d27f49859cd50bdb985f4b32e52ad8cab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888153, "uuid": "aac5ffd8-cbc4-4daa-9acf-149494e5f4d6", "value": "T1CBB31896DA93C4B9F8150071A165A7328638FE3A006FDE8BEFB89871BC50301D65D7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888153, "uuid": "124fca6d-f5d0-42ac-8e84-3fc16e92b6a0", "value": "3072:qDoz7EXGwlitE4y+eZK6LIl+MV0yZhPU8oDG:qkz/wEJyFZK6Lk+pKy8oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888153, "uuid": "7858891f-5148-4609-b3c8-888201a7a430", "value": 115664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888153, "uuid": "c8e9ee7a-56cf-42f4-bb5a-0bff5015292a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888153, "uuid": "e34b01d6-87bf-4e92-8dcf-c81471b41000", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8332d8c-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879569, "uuid": "23d1ff6e-6df4-4749-962e-b4e27f49438b", "comment": "Malware payload (Rhadamanthys)", "value": "37ccd812fd2e854cc5917c3b75790d1d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879569, "uuid": "8c67ac2b-8b99-4c0e-b0f9-25c989d97c1a", "comment": "Malware payload (Rhadamanthys)", "value": "5fd93c218359b9f16767e665bcddf0f2ee798c947e31a8db132d864c5aea69cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879569, "uuid": "95259876-8532-443a-bbfc-c3aafca43581", "comment": "Malware payload (Rhadamanthys)", "value": "0ad636ac601bfd8a9de4d88e5eff12d7e17e687f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879569, "uuid": "e4755b27-c3b0-4acb-b176-f0960a5bcfee", "comment": "Malware payload (Rhadamanthys)", "value": "3656a8d14167869504aec6d470eea7805312d68dc7c38605849fa8fe3df6cacb6741416754177ac98332d471830db0e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879569, "uuid": "ce3130e7-b2dd-4edf-9cff-8c6999a746dd", "value": "T11A93FCB8AF933D9D004AB3657EAD73FE8365E12D4B612221350BBF326E83315A5805D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879569, "uuid": "16c0c086-366a-4bd5-a0b9-7aa75d419004", "value": "768:GDhd0i7J4sYKgY/CMNfWdPGmG/GpGlGGrDGoDGTGaGHGJG4GLGkGpGnGyGRDGeGK:GDB7eKg20Nr3rG0tUMAgoh6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879569, "uuid": "864fd70e-45d8-432a-a5f3-a6f201db8224", "value": 97445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879569, "uuid": "61d999c6-1c8d-427e-942b-b43a94c16f06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879569, "uuid": "488c646d-a1ee-4537-a732-bb9ff68f313a", "value": "invoice-1637482117.pdf (74).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce7333a-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895979, "uuid": "b31db93f-5215-497c-8640-d163f102f405", "comment": "Malware payload", "value": "601accb0cfb0e73dae74ed76a9bdd7cf", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895979, "uuid": "caed7ebd-3337-4851-82bf-ad6aaeb474f9", "comment": "Malware payload", "value": "6005487861008a3f5178ce3c6a1cb3dea2f47f309012c46b9aec66090a421fa7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895979, "uuid": "c2edf606-80f1-4f12-ae79-be2be55231cb", "comment": "Malware payload", "value": "5e8079810cea10693e3ce7d679763310a2c14ac3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895979, "uuid": "ad228198-19ee-411c-8205-c06db10e0fd8", "comment": "Malware payload", "value": "f7e47ea74cb25d8e5ed23b6ff17ad2bf4fd9c64164f81f77e24d6a10c352e72eca4dfa4998efabb3faa534c941fd7afd", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895979, "uuid": "6da6cf68-4a09-44fe-b211-faf8dc4b2f8d", "value": "T1D8063314AF263DFA0668D32D60BF5F1D07D44F95947DF8CA9AA070C30AAEF96500AD6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895979, "uuid": "25313ef5-3732-4e51-8ab2-8b3a12b97940", "value": "49152:e+RN3X/2qmTOaUVlYK2gKrox++abVBSuTxFkY2TCwy4PXHX:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895979, "uuid": "f70cf599-0032-460a-a7fc-7ae03ef87eb3", "value": 4016965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895979, "uuid": "57d24d52-910b-4b51-8833-f0d7336ee0d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895979, "uuid": "e2b5f9ef-6f88-4c0a-94f0-4748145d448e", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9ab235-da2b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765854267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765854267, "uuid": "8c704b8d-de74-4b50-9fa7-7c6d1f89c4f4", "comment": "Malware payload", "value": "42a142469f1b20704843a98b4bd85f78", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765854267, "uuid": "16669073-a674-4720-8c23-78e541b67350", "comment": "Malware payload", "value": "608ef5c488fed74516e7f17ce719f82b94e5b02df108073d33e95dccfd696fb1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765854267, "uuid": "99b4a7f2-31d1-47f4-916f-f05735e98d30", "comment": "Malware payload", "value": "e3274f3cf23b7c289994fbb8b8e63e8a256facf4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765854267, "uuid": "3146a7d6-9cb7-40bf-bf12-7ab93bff6408", "comment": "Malware payload", "value": "0843e6adbef2237fb51e5bb04521f887f3736b9115640eb10dfccd7f56638d26c05455547d769233e6f8ccc717688169", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765854267, "uuid": "75610bf7-9666-4be6-a7ff-962502fdbf3c", "value": "T1CAE42940B689DEA9E9160230886AD2F31915BCB9C751614F39D8BF3FFA73748101DE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765854267, "uuid": "4652204a-d8a2-40dd-93a8-1e69e4736846", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765854267, "uuid": "355adcfc-a7fa-47cf-a72c-7ba33f026b9c", "value": "6144:6ahOEKe5v0bURyWKV0VC3QZd05Pp9HfZu5PIImWyLqke:6i+NbURpKVuC3SdgpRBuuWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765854267, "uuid": "1963ded8-a359-428a-8160-853e44c2a922", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765854267, "uuid": "a999fdd1-e353-4881-b1b5-10ed68978355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765854267, "uuid": "81ea4a7b-406c-4cf9-b3c8-12bb8a744a2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1228c2b-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879504, "uuid": "964736a2-940d-45ea-b566-276213a87292", "comment": "Malware payload (Rhadamanthys)", "value": "78e990ee2a6e3a47c98e5cbc36abfe5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879504, "uuid": "0c9f75e8-5023-45e3-8f06-2ce2ef0fad12", "comment": "Malware payload (Rhadamanthys)", "value": "60f6948745cd678e1aa3648ac0600ce8b6d1b56a4d29e3f3673ff4c80f2ffddd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879504, "uuid": "7728bcdc-e2e3-4f2e-b9e5-fd76e581b8ad", "comment": "Malware payload (Rhadamanthys)", "value": "6e6b94126e308f58cd0b2ce72c5e4c90618103ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879504, "uuid": "56022ff6-423c-4588-a84e-7b64683e4944", "comment": "Malware payload (Rhadamanthys)", "value": "4b72f5499d67f071f012668a15d8eabae7c7a73ed83f44e3b526574b8f15d8a2f80fab2b5521430036bcf8ef050b285e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879504, "uuid": "ba807a3e-afa3-4829-965f-f8004df5410c", "value": "T10393E7906F56DEA4E17265E33FC4FBB7C40D76400D4F70EC81A2BBB2A165A091898ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879504, "uuid": "989705f7-a6b1-427b-ac5e-e3bdc377a49f", "value": "768:GDhd0i7J4sYKgY/CMNfWdgXmX7XBXUXmXoXYXzXiXnJXcXYXqPXQJXhJX3X7XTXs:GDB7eKg20ilrgr73bzzAtMq6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879504, "uuid": "e959a0c2-d00b-4c42-a0df-899d8765bd81", "value": 97460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879504, "uuid": "1fd26cf2-3910-4a32-a302-8b4a79face73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879504, "uuid": "b76a0cda-774a-47f8-aa9c-3c929e1c5138", "value": "invoice-1637482117.pdf (85).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244ab8e7-daac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765909332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909332, "uuid": "6c144259-fb92-4def-9dd1-af5695fd3452", "comment": "Malware payload (Mirai)", "value": "211f863ec65feaa26da38419cc74c0b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909332, "uuid": "b35b1d08-0628-4f74-9c15-e844e454e600", "comment": "Malware payload (Mirai)", "value": "615eed4ff09520ca7ee8dec773ac7d87ad39579775c15a0a6e1e97fa98eef2ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909332, "uuid": "2b4dc58d-4bd1-49f8-ae62-78f75db3e6c9", "comment": "Malware payload (Mirai)", "value": "4a16e70c6747fdec1cf93b4e314fcee34d41bdbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909332, "uuid": "65d6fd12-6fc0-442c-9d6c-4d7a6ea8b23b", "comment": "Malware payload (Mirai)", "value": "deb703606959d6558367c4466fcc76ac0d228af2bdb12b7be59129a4cb92e1889d2a3dad24da8dc7a40b373daadd109f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909332, "uuid": "399abceb-8c46-46e2-8239-dbcf0bd7cfcc", "value": "T198243A02B71C0A57D1A31EF0263F27E083BFD59120F4BA85295F5B969276D372486ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909332, "uuid": "bd390e58-9ffd-4e15-931f-703ce3802107", "value": "3072:04g3pY29D+JhOz7qr+CZgUsK4gKWm0muf9ix6eNmisRUC:04g5Y20AEdZgUsK5KWm01ExPfyUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765909332, "uuid": "bdca04b3-7a77-4d71-8752-f412f9cbd1a9", "value": 224088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765909332, "uuid": "2a780d9c-db9d-4f23-92d1-d6f4c9c61633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909332, "uuid": "b8fc0055-997a-4d6a-ac6f-a37f37d92a1e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd7c888-daaa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765908811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908811, "uuid": "8c06b5e0-b7f4-40c4-a461-a903db48b7c9", "comment": "Malware payload", "value": "f8755b09aae361314ea1c1f12ca2e7b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908811, "uuid": "4878dec4-2e10-40fa-a053-b69d7dca0920", "comment": "Malware payload", "value": "61b5d23f69ced0009d9e4ae80247f49a67879d10e2d97bbb49d89f1da53947f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908811, "uuid": "0e696d4b-123a-462a-b398-071e8c100920", "comment": "Malware payload", "value": "5779e9391d33b00143a81fc0eaeab412526675e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908811, "uuid": "7debacf4-d840-44a9-a60a-c91a727df283", "comment": "Malware payload", "value": "30b7414d2f9e6d1112389322f95012ca5d307e5a899653283c8c6a593ba482a49c5b020b5ef2fac9bcb0b2e0edeb992a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908811, "uuid": "efb7be6f-45b1-4540-aebd-6ceac111ae5d", "value": "T153C33A167D519BB2CAC3627BFF9E029CB7261398E3DE710BDE245B54738A0270E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908811, "uuid": "8a4d7b52-76c6-4810-b807-152660b905cb", "value": "3072:ZpXmKc6QBczJjInlDzUoHMLCsZra8n850:ZpRchc1jIllHMOsda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765908811, "uuid": "f3a30d9c-a19c-41ef-9f7e-849c78aba991", "value": 120372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765908811, "uuid": "c3984d2a-b7e9-44cc-bb97-e72ec5c83d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908811, "uuid": "9cd54497-b58e-490c-b62b-21df25ec1ac1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69caf121-da6d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765882390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882390, "uuid": "fa739410-6fba-4d5d-b8fa-4a30c7adf35f", "comment": "Malware payload (Mirai)", "value": "329722f0f7de9cda7bbad43b425f5c07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882390, "uuid": "8ec371e8-c935-40b2-9318-3d9c1490705e", "comment": "Malware payload (Mirai)", "value": "61c5db9dd4aa0597da38b6050d884c7b71d32c97d74a3f5e9734d7f0e5f4f833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882390, "uuid": "12f5f87d-26f4-4a91-a0ef-6326ebeec3a5", "comment": "Malware payload (Mirai)", "value": "dab6a2a73b31bf0d973bcd03c908fdb5a4255f7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882390, "uuid": "1b88b253-136a-4133-95d5-ed4d5a08b1ae", "comment": "Malware payload (Mirai)", "value": "85de57880c105947b6ffdb56c70c13f870d597dbd9a678299f2d35315a2d521d6e9965087bee2a13bf053a6e29dccbb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882390, "uuid": "882e9129-c84c-492e-8b00-7583490bf724", "value": "T13AC32944BC429A26C6D7277BFF9E039D331613D8F3DE7207E8246B547B9A0160E3A925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882390, "uuid": "cccc3c5c-85f6-4d19-a79c-16b8a912cebc", "value": "1536:9PhOe2aSSwnZrgfVVazV7xO7C2zzR5RnYush3TGGKFgwjYZO8nX8VR15ZS:9PU1NZ7xO7CGfsh3rs7jQO8nX65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765882390, "uuid": "245e9eec-e46d-4c7b-8900-7b03737edd71", "value": 120412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765882390, "uuid": "cff68dc7-57f3-46e7-94e1-5e8177dedfce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882390, "uuid": "4a3a4989-b390-4e89-9e50-3adf8032a788", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6097e85-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765883377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883377, "uuid": "eddd6d94-5448-48a8-b9bd-32400f831d82", "comment": "Malware payload", "value": "3ec48580e9c3c97304a8ea520bc5aa4e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883377, "uuid": "de9a589a-6770-40bd-98e2-515c716e56a6", "comment": "Malware payload", "value": "62484ed330ea7db23eb6da5216d625bde68026659447d92ab9c13778d6c7829d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883377, "uuid": "511f407d-acec-491e-bca5-78107d839761", "comment": "Malware payload", "value": "d8134c7a76434f49fe2df82f88fdd855903fe2d2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883377, "uuid": "0126da99-6f32-44fc-b07e-84f8d76a7776", "comment": "Malware payload", "value": "8ec520abb34aa0a769cbd9879cf2f99b880ac5885d743fa888879ece08981418430079ef9a6ec393293b86702979ecb2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883377, "uuid": "f1cff8d4-2629-4a7f-8101-810fddccce43", "value": "T110A3BF66A90272EF0CA7017E8DF8176E65A4744A66E0D4CDFC6DE0240F1913DCBB65BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883377, "uuid": "8dd165c0-dcab-4c44-88fe-90761f0c614a", "value": "3072:ZxesvZAalrQ4nXwjGLA0h9u0GKiaI+UEmVRsk:mWZAcrQ8ASr6aI+ZmVRsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883377, "uuid": "a9be3556-3fdd-4b02-b780-9ac0d3e64f02", "value": 98692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883377, "uuid": "a0c02654-786c-42c1-b870-11d3a3aade54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883377, "uuid": "53e68002-4c9a-4b1e-b684-2f91e33b8005", "value": "Invoke-xxxTcp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e013b55f-da1b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765847370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847370, "uuid": "c33e6776-c29e-4899-9b3c-2b82d207ce83", "comment": "Malware payload (Mirai)", "value": "dc6b7410cc4f3ba8d9d43a6bde6e2183", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847370, "uuid": "35273c4c-3b6d-4471-a61a-993a09e88be0", "comment": "Malware payload (Mirai)", "value": "6269c29c471bee0534d2df7af60b52a18238169e5191177de8e8e54b4015ebe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847370, "uuid": "47d1b8e7-c802-4edf-b41b-e3a1762b51ec", "comment": "Malware payload (Mirai)", "value": "5c3804572d153860a5d7db7d0c256657c84da5fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847370, "uuid": "657bb03b-a133-40e5-a24e-7d347c0bed9f", "comment": "Malware payload (Mirai)", "value": "b65bd83fc13a6a7efe91766189f12f0e5b8d7655273d669af3f7986f4c08e5ed0bfe6e30486dd279b700a6afb46ef273", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847370, "uuid": "db3ead9b-c7cc-4216-aad2-ac83fb7db0b3", "value": "T1C5B31905B30C0847D2633EF4373F67D197EFDE8121A4EA40255FAA8A9172E32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847370, "uuid": "96636869-4ae2-44dd-90d2-4c0a68de12bd", "value": "1536:A4ASUxXk06AqSdkSoHLvAydNYic5Q7X4aL4/PLVL/9CG:fAFxXRkhHMyXX+57kG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765847370, "uuid": "77745890-d5c6-4afc-a533-69bf9dd81959", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765847370, "uuid": "c02fa19b-c230-4f3a-ae88-35b1f32b57e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847370, "uuid": "641803b3-ff0a-457f-8d57-52ccdb786ab3", "value": "nuklear.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12684e7-da9a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765901811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765901811, "uuid": "34a215a0-80f8-4c0e-a50b-100a752bedb1", "comment": "Malware payload", "value": "f5421556e732e405a0ee770239414063", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Khalesi", "colour": "#655F52", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan.Downloader", "colour": "#DFBD27", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765901811, "uuid": "b246d3da-41f3-4374-a0b0-cd0364987c48", "comment": "Malware payload", "value": "628b3d1725dd4d33e8e2a4052a3f91603088198c8629d6aa386a868977c49879", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Khalesi", "colour": "#655F52", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan.Downloader", "colour": "#DFBD27", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765901811, "uuid": "4e7b8de5-d3f2-4311-b45d-e584efc53230", "comment": "Malware payload", "value": "deba423235f67194e4e79d64179d48d9ae4c992b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Khalesi", "colour": "#655F52", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan.Downloader", "colour": "#DFBD27", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765901811, "uuid": "fc49293f-7ee6-4d75-b0d6-082389435ac3", "comment": "Malware payload", "value": "902d583d299e32ca421217d926663212b6e1d91dc8ae191648079ec8fe93f8e59c820c3874c5ea64c8784ff106bc67af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Khalesi", "colour": "#655F52", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan.Downloader", "colour": "#DFBD27", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765901811, "uuid": "47b36781-c8a2-4ce2-9e50-0afe6d9cc69c", "value": "T16FA68D40F7C381F1D9CA01B0652BB77F9535774847289AE3E3942ED9A9312D23A7B28D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765901811, "uuid": "8819b25b-9479-426d-ac01-fdd790f436f9", "value": "90ad2364f9a8390548bd0f3054022715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765901811, "uuid": "fa342c98-52c7-48cb-a555-970d9afe9fdf", "value": "98304:zHZUK424G4roVRnzPqhGyV8gw240CAlUcu2rDOYFpTPaeW4t8P5EYF85b/yPSOH:cVknzPqhGy424fT2rDOY3Pjt45E/X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765901811, "uuid": "5725b792-6e12-4038-8aaf-38830ade0d72", "value": 9591368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765901811, "uuid": "547bec63-54d3-4a61-a337-12f866a27b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765901811, "uuid": "ba4f6966-f9f7-4e98-96e4-b25e9df98953", "value": "Zxl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc52ca3a-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765879630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879630, "uuid": "34f9f95e-71d3-4ce4-bbfd-bb4048bac1b5", "comment": "Malware payload (AgentTesla)", "value": "cea0e60394f3e1f8bc664fb91bdec70a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879630, "uuid": "2eb9ec6e-2cf9-42ec-9cd8-3af0d3b79b1f", "comment": "Malware payload (AgentTesla)", "value": "6299e2427b20a7c97323b8b98fd7e4c8c89bf3c12bcf64a89ba522d276d70807", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879630, "uuid": "c2721b41-9474-4d79-828b-430e13821655", "comment": "Malware payload (AgentTesla)", "value": "4d7028d4704c18e3fdc374b499f6dbba62494073", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879630, "uuid": "4059e3c8-4c5b-40b5-bd4e-5a26e17a0b10", "comment": "Malware payload (AgentTesla)", "value": "0d0edb1735b7b496edffc7afcf6d06fbfa630f1ea4917b52c4d9052204f8a8e7003f5ef9e18ecd2b576bb4fef9362f2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879630, "uuid": "b87dea9a-f041-4382-bce7-7289ee45fcb2", "value": "T1B645F2118DC87FB5CEAC5A1C80BE261ED3E04B8E442A6549FB3BBE46AFF7644010F195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879630, "uuid": "dd8e16ce-eb27-475a-bfc1-7134e7e0cd4e", "value": "12288:tzl1lqpBozb7QQ6M7xLW3DJzTCkSg1dU3GWcR/nmljD18nmuA7ZZ3X4nPhJGbDkx:t9+oN66y3PBbU38RO3VNloJiJV8slFle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879630, "uuid": "d43b99ff-47cf-4a62-900b-c6fc6025df58", "value": 1273324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879630, "uuid": "cdadc251-42e9-453f-81e2-3dbd58f2f778", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879630, "uuid": "710742aa-feef-4761-8d7d-36e77d94d474", "value": "New Order 12162025.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39348e26-da4a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765867277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867277, "uuid": "450069fa-2060-4901-9cf9-ce0886b8c541", "comment": "Malware payload", "value": "b9e89532c6701061a842507746d5973d", "object_relation": "md5", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867277, "uuid": "a204f980-8719-4963-b2d3-c68068d9f294", "comment": "Malware payload", "value": "62b9bc3cd610ec30f1e1ce0edfbb9f4baaf00004f88d2b3db23ee13d983283e8", "object_relation": "sha256", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867277, "uuid": "d9f7a756-06d5-47ae-ad4a-7151e14db3e5", "comment": "Malware payload", "value": "9caf9c2d5e5f24d92b77a420f18e1414741bb957", "object_relation": "sha1", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867277, "uuid": "2bc11eb5-93e1-4af0-9935-f00f8b6ecfef", "comment": "Malware payload", "value": "d4322187b53f95380a04626ff4fcfcbde271c1a25bfff2403a9147a78254ccf529d7284102a9d82fe38903ee6ae91906", "object_relation": "sha3-384", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867277, "uuid": "2a8d886b-d17f-4959-bbee-106502765c19", "value": "T108073362952DA8C3DC72E37839F7DB0A651FD59567726B8F0F3BE6885CA9081430A30D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867277, "uuid": "9e0a6a2b-de28-4edc-b526-8a21f3640437", "value": "393216:BXmcBVFq2lCklve8n2DfkkY3ucN6ON2LcIugmgnh6T18OuXnkZ1g:oc9q2lGfDfkNuc8/Zugmghq6OsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765867277, "uuid": "8595d6f9-b51e-4944-9ae6-15131dc24c59", "value": 17370921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765867277, "uuid": "0133a119-eabb-4ccf-b369-cbd978eeed23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867277, "uuid": "50d86d0a-f160-4d84-97b0-c1be544a7949", "value": "PhDec15MA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e01cc6-da73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765885063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885063, "uuid": "13c0d07c-6b77-4e3f-b578-1b4a8d97039f", "comment": "Malware payload (Mirai)", "value": "5802416ff4964f364f30b5af28e20931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885063, "uuid": "78f2cb80-390a-41f7-bbb8-5b8b653ad8eb", "comment": "Malware payload (Mirai)", "value": "6338a1b14315ac6944d46ea20b6b1523d00ebedf34bb86bca8745e5ce41d457e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885063, "uuid": "9213c950-c503-432e-ad01-04893118af6e", "comment": "Malware payload (Mirai)", "value": "b43320321d76e5fc5ec9735d2359e966e367a909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885063, "uuid": "0b491936-bcb2-4d1c-9fdc-82b175e7d4bb", "comment": "Malware payload (Mirai)", "value": "36cacef41ccfc5754faa08d90c98940abf6a24e002e8421ebc0ae02a984e463a371edb6a41a3c138822d8fd12b024f34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885063, "uuid": "d6aad9c7-9493-45fa-a335-aaa409911237", "value": "T12BB31A86A3194303E1434FB6BE3E27ECDFADA95091A8BB4C261F760C4576C364447EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885063, "uuid": "492da1de-cce0-4bd1-bcf1-8f8e45d62580", "value": "1536:e+XZ3OWzmyWsMUwSij74dXPWfNZSgrS4BydYtf8nTo5S:3BtUSij7wKSg+FK8n85S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885063, "uuid": "08dbe2ae-6bf8-489c-a131-06bbe4ac0c71", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885063, "uuid": "f472a735-9f37-4cf6-b46c-6fc5326bb89c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885063, "uuid": "fce0321b-3015-44fe-b2fc-cae9d4ff843a", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31556b51-dab3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765912361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912361, "uuid": "73e23a4e-10cd-4b59-b3be-117c1d262024", "comment": "Malware payload (Mirai)", "value": "82db0c9ba9d22c47130180b47ae9225e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912361, "uuid": "0469c76b-ddef-44d5-bdf5-4ccaff28c58f", "comment": "Malware payload (Mirai)", "value": "633fc67370c556bab81d0f3f6dcd64971dcf49ef0cbaf98a085975c93481dba4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912361, "uuid": "4866ddc0-7744-4c23-89a1-642759a96ade", "comment": "Malware payload (Mirai)", "value": "e0537fba5b35a5923462fc7bc24a03c6f8fa8e30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912361, "uuid": "a51be0a3-b0d3-4644-ae1c-2303f033394f", "comment": "Malware payload (Mirai)", "value": "17fef6bdd51b546a3342a6aefba36ddcc797ad7c582d4204126072392a60403421c2cefb1d91faa110702ff59007d7c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912361, "uuid": "9a396fd6-fdc4-4adc-964d-c9bf3092a657", "value": "T130F3B4086B614FBBD85ADC3785EC4B4D199C650322B83B3A7974EA04F64B24F1AE3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912361, "uuid": "aad71165-c94f-4d3c-88c9-bd8ab252b54c", "value": "3072:5sPFLuddMSDTCglGd3R6NGzLZ8nXz5dWW6:5sPwrjJER6NQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912361, "uuid": "c3bf71d4-e242-4ae0-a75a-f661f11b66bc", "value": 163784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912361, "uuid": "3f9fd0ca-cab3-4c5c-8345-c0e499aee6a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912361, "uuid": "af17198a-09ae-4226-bff6-39699c9b598b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0845b562-da5f-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1765876214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876214, "uuid": "f9fc2c62-5739-4ddd-95c6-016ea20ff834", "comment": "Malware payload (GoProxy)", "value": "712b08229cd3eed6ef235184a4ceeda8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876214, "uuid": "9c4398fb-2fed-48c6-b1d8-e69bae3a9903", "comment": "Malware payload (GoProxy)", "value": "635aa806da671eaa554367d1ee0381faffee4bc65a7911ca75aefd2edff91835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876214, "uuid": "668806a1-e7eb-42a6-99de-8ab9a5725cb2", "comment": "Malware payload (GoProxy)", "value": "47eeae11cb60ec6d522ba3e9e060d33e79ae274c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876214, "uuid": "eecf1080-fc67-430c-9fcf-5fee32da4a53", "comment": "Malware payload (GoProxy)", "value": "50aa119cabb852c58e9f2ec2181d340ecb3378a3134c65038c5dcf386cd2d5a670f2c0a2d4b0820eb8af91f1caf865a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876214, "uuid": "2bfe2209-6779-489e-817a-3bb97435da9c", "value": "T1E4664A03ECA175E9C0E9E231CA66D152BAB17C485B3133D32B50F7292F76BD06AB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876214, "uuid": "d4f05083-1538-471a-9b13-0c8c66b826d1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876214, "uuid": "fa3c1dd5-2790-4f13-86ac-1ab5c99e839c", "value": "49152:2IGd3HPGwjNSFDAcG6E/pmWDNM7eOwY9HGwFg3+Kxrlu0cULiU6TUD0mahhLjt0I:2fejGNROz9mwXUrlu7N+bzBE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765876214, "uuid": "88b7235a-5766-419a-a218-1e6667e83b0d", "value": 7039104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765876214, "uuid": "2db0bf38-487c-4fdf-899a-42f9232140e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876214, "uuid": "68ca9fcf-bc29-41f7-a66a-2e98c3ddcc8a", "value": "635aa806da671eaa554367d1ee0381faffee4bc65a791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c016c7-daa4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905850, "uuid": "16d43350-5e67-4cfa-baf7-10c38f2e2e55", "comment": "Malware payload (Mirai)", "value": "1a2e6f1a08bba5bee6bfaed1cd79e405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905850, "uuid": "70181fbb-2a64-40f7-883a-7ec189564849", "comment": "Malware payload (Mirai)", "value": "6381a006e7de4fd8be0986c3b26b6baf7d384f928fb06d2cf4dfdeef293011ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905850, "uuid": "4de34bfc-8ea0-4bde-a9fd-b0353b84d71b", "comment": "Malware payload (Mirai)", "value": "2dad248b282cbc2739ba81f04b9bc2ed621b2661", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905850, "uuid": "5975c369-de13-4fdd-965f-f35263655d4f", "comment": "Malware payload (Mirai)", "value": "1263fe08c824f50f9931da9b6391bec4154597792d78f1511796443b127a1c2a4499703b5a5f9c162120f4d945687d95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905850, "uuid": "dec58a0c-4706-47d7-ad68-fd5f80844d3a", "value": "T1079329F6DBC2E075F431043A90664B72DA35FD7A0289D68FFB259E304C91A0197B5BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905850, "uuid": "9a38ef60-cd60-4c69-86d0-7c61a06e72a1", "value": "1536:zkr+lUz7ocCREDFbjJ8Uox6M6mkGM8IuVaS7rwDVnwMyP2AIiL4bKgHCoDfsBB8:zkr+ldcC6DTaxt7kGAdirGVnwfPD7LSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905850, "uuid": "3010d3b3-93f4-4b2b-84e7-af4cc351064c", "value": 96912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905850, "uuid": "e4ccff32-7cf6-4f9c-9fa4-0cdbaf293802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905850, "uuid": "e75887ac-8c5d-4832-a682-0f097a9d6f98", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8820d036-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873851, "uuid": "ff14a1c3-625a-4380-ae77-24dcec183ea5", "comment": "Malware payload (Mirai)", "value": "8fd6f60758d74ddcedc7c9c72bd17423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873851, "uuid": "6bf3840c-7a0d-4ba9-aa6e-cf121126eedd", "comment": "Malware payload (Mirai)", "value": "63bb071587b576f67e5f4a769621e19ce7b2b2d62310912bea71a30e7bdc4a37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873851, "uuid": "7aafb33a-99b7-4084-b8e4-9b50e06f13cc", "comment": "Malware payload (Mirai)", "value": "e4be4b6acb27fba412081545e8162cd6b693829e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873851, "uuid": "80f68338-55df-47bb-8976-be8f2dfb35f1", "comment": "Malware payload (Mirai)", "value": "0e8477ce60fdf84b72320ed9966cbd6c02ef300939363e23b5d31bceb2581345bd0cd8c759b92e7b5ca0d1d4a5786fbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873851, "uuid": "27347174-3dec-46a1-8aa2-a59b971cd7f4", "value": "T1DF334935B6752E1BC8D9997D22F34328B2F5168A34F8CA1B7E720E5EFF2085025172B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873851, "uuid": "ceb228d0-5f74-4926-b366-3f28b0a6da2b", "value": "768:bD7PczVp9uzLEpNUENwmcxXEpXEmKteNwju/QJQO+H51TGNz:bXkz5u3EpNUENw7xXEpUmKe2oQJ6HCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873851, "uuid": "48b42cde-aa4c-4d29-9e06-c980b915f3fd", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873851, "uuid": "4dddc017-b0b3-42b1-a7a9-23cb42be466e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873851, "uuid": "a52afe38-bced-4322-9602-378b403899f1", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b55625-da82-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765891239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891239, "uuid": "80be283f-505e-4b57-a6c3-11b48176d94d", "comment": "Malware payload", "value": "d0b05a3311e7e814e816348024d56a55", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891239, "uuid": "b82649ea-f289-453b-bd8f-53179fd6bad4", "comment": "Malware payload", "value": "6481201192b562dea5075b3815e3f8b33d1c97ef7cf576fb323dd97a6f487950", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891239, "uuid": "24f3196b-8225-4beb-8ef1-55dbfd635f13", "comment": "Malware payload", "value": "05a72561685e6f5204295934bea753464c5dedb9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891239, "uuid": "50ea3156-a739-4cd7-a8ab-e18b30a209b5", "comment": "Malware payload", "value": "485fd1b9ab54a544b08a2c00a9b716f83254f65c19cf90c8219aba7e3029d204cd4c38d2cb26465b9652a4d0cd5b59d4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891239, "uuid": "e79c76c0-7477-46bb-b532-3af33415dd39", "value": "T14C23AC5DC78F40A5CF556373532A0A4506FCB33EB21551B674AC933237ED93E48A98B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891239, "uuid": "029bf5a7-16ff-4c63-8dd4-28e35d1e9249", "value": "384:J99ur15r2IWNRZPOj6UxUWIkVaUG+XvcijCNxX440E+S7:va15yIiPOuYVVaL+kJLo4oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891239, "uuid": "c7c288c1-37a9-4d73-8714-056f072a64d4", "value": 46535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891239, "uuid": "61b863ee-b2b6-4a43-92a9-b80e4a85e360", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891239, "uuid": "5b684cf3-24e3-4c5e-ae19-bfe5e7e9157a", "value": "6481201192b562dea5075b3815e3f8b33d1c97ef7cf576fb323dd97a6f487950.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebe4ff2-da6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765881271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881271, "uuid": "bf3b03d9-7117-4978-bb93-f8cc36ad53a6", "comment": "Malware payload (Mirai)", "value": "d65b0991eb1aa1b087baead3ffc12ffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881271, "uuid": "955e906a-b628-409b-ab82-1e94e1f011b1", "comment": "Malware payload (Mirai)", "value": "65379591f0cfdd922398fb77ef57beab4efce3d44b568be98d0e5d7a0f148de1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881271, "uuid": "df4867f2-9a8a-4d4a-915c-ccdc89441766", "comment": "Malware payload (Mirai)", "value": "a2f0b510093261d4c5b17af13178c84b9aad4fdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881271, "uuid": "9453fbdd-44d5-419f-9708-d463ff41f6d4", "comment": "Malware payload (Mirai)", "value": "b71745e4bb5d99e8a2297ef76b1078d1dc99d0b53ee8e9fab082988095fa41c8c1cfd54a3f28d60b2ae7064e83804c12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881271, "uuid": "15cdc812-0749-45d3-a0d2-040229f8c4b3", "value": "T129733B81BD815A13C6C412BAFB2E028D33271BFCD2DA3207DD25AF21379696B0D7B655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881271, "uuid": "37193417-02a3-4af0-8f0e-f1f6607f6214", "value": "1536:LMA4wBZ9Mfrz5LPfkLOSSk+EmAvHLyecSvYl:AA44zuVfkaSSk+EmAeKYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881271, "uuid": "c4bc9fb5-8208-485e-8f78-9ab94dd2aa6a", "value": 73632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881271, "uuid": "b1ea2d6d-aeee-486c-9abb-5941d2e7d68a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881271, "uuid": "0bd19cd1-f32f-49f2-a02a-a27ce99f25b3", "value": "karm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb64726f-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879521, "uuid": "dd5bfe46-70ad-4026-956a-52c4daf5b384", "comment": "Malware payload (Rhadamanthys)", "value": "2b6bea3f896ed38cc261fe21275380ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879521, "uuid": "de8c56b4-b4a9-42bf-bab6-7d848abde079", "comment": "Malware payload (Rhadamanthys)", "value": "6558516bc9fd2f57cc3ee17268cdde6ded52bbcbfd45668a926fb41ed08605c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879521, "uuid": "9ad3c366-733b-4249-82db-dcf2322bd0e8", "comment": "Malware payload (Rhadamanthys)", "value": "4bb4cab98d933abaacd11b33f1303e56972aa664", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879521, "uuid": "bad1b40d-5958-48ca-9c98-593a589fba7d", "comment": "Malware payload (Rhadamanthys)", "value": "da8ed80f30772c2be972c3048c8404c69cce418067042fc39c7f1ef14525216487bcaef74308f0af5e4320e89732b429", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879521, "uuid": "7b5cc0f8-311e-465a-9d3a-97ae3070feb0", "value": "T147A31A093577EEE0E4F0BD200A995A73EF4D9D85191A8BE3E938BF718474D348911BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879521, "uuid": "7380617d-fe94-41d2-889e-42f764645e1e", "value": "768:GDhd0i7J4sYKgY/CMNfWdzrXILrXDeVHzyqegJAH1ZmSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20zrmrXDepJAHfm6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879521, "uuid": "365d64b9-3aa5-41c0-b60c-c74cc08210fd", "value": 101325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879521, "uuid": "76194736-2230-4149-834c-6a5dbde814cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879521, "uuid": "193f4b8a-18ff-4922-93ce-8df77a46fdf4", "value": "invoice-1637482117.pdf (83).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7072126f-da82-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765891421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891421, "uuid": "4ffd2037-731b-4f17-9f32-543e3bf805e7", "comment": "Malware payload (Mirai)", "value": "3531852156a6c467abb670380df66408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891421, "uuid": "a72e5abb-f8c3-4ff2-862c-aa4141422062", "comment": "Malware payload (Mirai)", "value": "656d001c4576b3f37d7fd381dcb16a69a65ab38619992b7145b94dad4950a1de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891421, "uuid": "d1afc9a0-ade6-4ffb-abb1-8ff27a2c1b89", "comment": "Malware payload (Mirai)", "value": "eb6381e7bc12774e39ebe29367cd77df32696528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891421, "uuid": "e5eef15c-9fbe-4328-a254-2f8f0c515659", "comment": "Malware payload (Mirai)", "value": "a7ce8a28b6685c5f11795ea9f4af8cd0dfb92e198235783907c563a478d613a1bd67b751305dc9130bab26e3cf1c46b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891421, "uuid": "a73d0703-440e-4c7e-981f-757ee39bfa47", "value": "T103A30A54BC948B55C9D023BBFE9F118C33165398D2FEB22BED106B95B38A4274D3AC46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891421, "uuid": "b73fb47d-e332-4dec-839c-51128b2f198b", "value": "1536:aInn63vrdQZLmu15I99h3GlQoACwxjkGpRP5+022d2ynHFMpi+N8FBrSVns54uue:9saaQwxjkGpRPH22cN8FBrSVns5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891421, "uuid": "0c748580-19f7-4d12-b315-304c6a1fc24e", "value": 99752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891421, "uuid": "8592b36b-d999-40c6-bb1c-f30b9a298334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891421, "uuid": "32069e30-f590-45d8-925b-d3440146d0d7", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3609cf-daae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910449, "uuid": "d66a3f1c-51d5-447d-be65-2c09cd00ded5", "comment": "Malware payload (Mirai)", "value": "53465caecd41378ff3a1b63f7c47a14e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910449, "uuid": "9d5a3874-7458-4b04-a4b1-9ec8c3ee3be4", "comment": "Malware payload (Mirai)", "value": "667669a88a7dc87f0ece2055912e95a0ffa8723087db871cc306b267beeccad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910449, "uuid": "d386160c-c278-488e-acb4-732cff0b96d5", "comment": "Malware payload (Mirai)", "value": "79c83a60a9d2e1595fdf1f3e13fd66c12a143fdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910449, "uuid": "881d7919-7784-4b3a-838c-d8e0494437fa", "comment": "Malware payload (Mirai)", "value": "d75e5d6258403af58bd8fa8b3f6de05d663bbdb717b7b0205513097bfc588432ca39231981f8708de5932763a00ddbf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910449, "uuid": "d8cffef3-edec-4115-80e3-6296d071a452", "value": "T1D2F3D60EAE219F7DF2EC537997B34F20D95A1A922BE4D560E1ECE9005E7030C586FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910449, "uuid": "6535f141-7203-49d0-88b4-2ca89e1a21e4", "value": "3072:qgAimeipuEuU9M7FWaPuj7JHe2rGk0fX9Fk/sCWN770jVU6m4kpBXtbdfTlgUXyH:qzimei42+VHqm60+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910449, "uuid": "7b3c74b0-d042-4e7d-a5dc-37027d305cac", "value": 159624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910449, "uuid": "021d277b-335f-493a-b7e0-4e63072321e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910449, "uuid": "0258dcfd-fe94-41ae-9c03-0d61010720f3", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c67128-da50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765869849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869849, "uuid": "e36a4fd1-7dc3-485e-a41c-9b8a6457bf2f", "comment": "Malware payload", "value": "0638b9a3475e0bbfb60266dd9377f95e", "object_relation": "md5", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vproj", "colour": "#984EB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869849, "uuid": "6b8cd5f3-610d-4003-aac0-a8d0c9bbfa2f", "comment": "Malware payload", "value": "66afde661afb4126abec92034e7161204861f84485a400835aa65a7d31dd7a16", "object_relation": "sha256", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vproj", "colour": "#984EB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869849, "uuid": "aee302eb-393d-4b7b-b63b-af878e0a36bd", "comment": "Malware payload", "value": "751f37eadfc947275c26ab7a3347896b2fcba567", "object_relation": "sha1", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vproj", "colour": "#984EB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869849, "uuid": "76e8540f-4d95-4010-8832-b85343d24f36", "comment": "Malware payload", "value": "34a74752a4a13be935ae7e64cb333507ea5de45de351485bdd1eafa25d58b1756f6ac5245dc20cba54325936a2772c28", "object_relation": "sha3-384", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vproj", "colour": "#984EB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869849, "uuid": "17f99eda-175f-48d4-b7bf-13cba8c909e9", "value": "T11C21B718716D8B50C573DCB3ACDA1186425946D96AD0077FAD903B479CDA1BCE67301F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869849, "uuid": "ecc855de-5215-41e2-820e-4ce32388b779", "value": "24:9zcVAlbcwsYZYCYnV9jJtsAvZQJSANfOV+WKiW0j4cvKNSnV+yz44cdalcT:9zGAGuujVBJtfvZQnfOV+WWfcvMyVL41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765869849, "uuid": "a66d976f-ea31-4bff-969f-5321d4f5bc1e", "value": 1264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765869849, "uuid": "f53f0a2a-e927-420d-8381-fd95fd9a8aa5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869849, "uuid": "e12a3065-b6ad-4491-80a3-edf305621ce9", "value": "v.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4469944-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879992, "uuid": "6eefc6c4-9981-4eb5-97ef-716361d50bac", "comment": "Malware payload (Rhadamanthys)", "value": "945ba842be8c40a62ed45f8bdf622eae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879992, "uuid": "98eed0dd-e551-4ac6-9778-2ff97f778548", "comment": "Malware payload (Rhadamanthys)", "value": "66bdda1065842cc4e422fbef002447d0dbdcbb77da52a1ea306f6799e16fe849", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879992, "uuid": "f5d4dccc-20fc-45fb-b8cd-0943bbd130d3", "comment": "Malware payload (Rhadamanthys)", "value": "2a44c6187b268c9cdf1c9f6b16c193bea495b4a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879992, "uuid": "1f79842c-498b-4a54-8e7f-c1eace2342a6", "comment": "Malware payload (Rhadamanthys)", "value": "745008119806ebf4f4be5dd53790d3f2d5b942dbaac7fec13318b07c1db829508ef92af46e27a6dbfa9da7c77bf3e646", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879992, "uuid": "4e8ec714-91e7-400c-b62e-e054d1f3c09e", "value": "T1B3A3D87028201EA829D9BBB9978D30FEA83FD03A9586145385D73F154E6DB5E2F0E1D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879992, "uuid": "597b29f8-239a-4147-a5e9-f6878e7cd6e8", "value": "1536:GDB7eKg208Q7v8CUMjdnZeal6tyyucrVn3Av3DrHj1l7Er+n/yZxrbC8I16kj01v:GDB7b0mVbMem56BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879992, "uuid": "cbbe9a8a-b4dc-4a52-8025-0769adca2696", "value": 98799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879992, "uuid": "ca493fb0-eb74-4a59-b44a-c51dfff6a575", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879992, "uuid": "f3c62cc0-518d-4aab-b51a-4394bf4338a2", "value": "invoice-1637482117.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fde70c-daa4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765906052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906052, "uuid": "99859f19-7e2d-4a7c-89c5-6d9f2689a6ef", "comment": "Malware payload", "value": "6ffe8b81f6c7f28f600e3d407ccf094c", "object_relation": "md5", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906052, "uuid": "ac806693-fa83-4396-826d-5d08e5df3df2", "comment": "Malware payload", "value": "66ef87c23f088cc417e9dbac077eba737d8a83fd8f494cb3a2ee0367b4c8f144", "object_relation": "sha256", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906052, "uuid": "7c7f3139-e736-467b-a737-2cc03a8a8ee7", "comment": "Malware payload", "value": "cddc69010065957d8af88f8ee771f679cb124054", "object_relation": "sha1", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906052, "uuid": "a4e477c0-b8cf-48eb-aebf-b666595dcd84", "comment": "Malware payload", "value": "af3f90fb09a3632734fa1b990cf27c1a058dea7087a553cff81aeb71645e0b33b32af9ae4fb155c2542aec4b70938590", "object_relation": "sha3-384", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906052, "uuid": "27001bb3-6e8b-4706-84e1-db016bb69cd9", "value": "T12F4733EFCEFA3645E46698F07A52D46C1BE7C52BCE213162EFB09261705D5C430BDA22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906052, "uuid": "be05ecbe-c6b9-418d-a605-0ce2a18aa786", "value": "e7b89a93b2788977e5bfcaaf3cd602fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906052, "uuid": "4f188724-67cf-49fd-b524-6f6fad94a329", "value": "786432:/bUPr17ZDnfl4AqI398pyfMdy3YTTAeCC5TQdg:IPDDnf+AlNX6yYfALC5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906052, "uuid": "237205fd-412b-4242-88cf-d13ece3dfeec", "value": 26540544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906052, "uuid": "a8a9802b-ca9e-42d5-862f-5a931b1ccf7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906052, "uuid": "e0ffefa7-b551-4b03-8af4-84bbbbf6ed72", "value": "66ef87c23f088cc417e9dbac077eba737d8a83fd8f494cb3a2ee0367b4c8f144.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be77b110-dab2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765912168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912168, "uuid": "8d8bdf81-2f8e-48cf-af99-7ddf4cad7b2d", "comment": "Malware payload (Mirai)", "value": "7a3da45ab502e2f9df6498daa5262d3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912168, "uuid": "99708fcd-5112-412b-8948-07b11f969556", "comment": "Malware payload (Mirai)", "value": "67e3d230830f10fe7b9e5386ae88fa93c600c2b49b9a8d4c7608d137202918f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912168, "uuid": "daa39f41-b85c-4844-829f-1b3ae9a25174", "comment": "Malware payload (Mirai)", "value": "9561bccd919392b7658120883b43b95fcb479fc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912168, "uuid": "96e98686-61ab-4db6-885c-b9053353cdc5", "comment": "Malware payload (Mirai)", "value": "f7e155584feca4f430c86ab1f7099898abb12df8c3eac2acc86c5e3a3eb274db2c2cd8de3725c5350f7695752e41fc38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912168, "uuid": "2cd32ff0-a2b5-45ba-a433-13fe8c1bba98", "value": "T15FB33996B001CE7CF90B927A857B4E19A928F7519F820F27E593FC93B9220D47D29DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912168, "uuid": "327ee4fe-416d-476b-bd54-626f99eed538", "value": "3072:er3Lk5EqZzh33nT+Tc/NuDAZRbs3pfWT5bMe:CkGQd3j5NomOeT5bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912168, "uuid": "45b52f3d-bf53-4c4b-a966-8bfddd30c55c", "value": 117436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912168, "uuid": "450a8a60-d214-4443-b175-344431cbeee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912168, "uuid": "bc6085e9-091a-4549-b867-d54288c28f88", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a55689f-da79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765887492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887492, "uuid": "387229d5-c384-44b5-9fdb-974524ca21e2", "comment": "Malware payload (Mirai)", "value": "62adf79dfb53ce42cffd16dabfb8ce0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887492, "uuid": "0c1ce2cc-49d3-4d67-b816-561c0a1075a6", "comment": "Malware payload (Mirai)", "value": "684154a36dd2405ebf21c7007928982632034ee73915e4af06ad583d38609b22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887492, "uuid": "62b0bd70-42ea-4254-bd5a-7a87bbd17718", "comment": "Malware payload (Mirai)", "value": "6baa944253e3379518ccc91945d41cea1edce16a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887492, "uuid": "9006e50b-f9ab-414c-825a-458c0de819a6", "comment": "Malware payload (Mirai)", "value": "c063fb18182c8db78392a6ef9c936f70201cb9235078d274f561bddcabfd8ba4b5d18019b1938ec055803b4e9874ae0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887492, "uuid": "5de3a72d-d270-4446-9701-fe075c0d3d5d", "value": "T127C34B26FC753E37D0D470BB42D38921F1755B0810A4D629BDF20EADDE3B1602A9B67A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887492, "uuid": "2fda25c6-3b36-4487-81f4-b0974ec2e279", "value": "1536:xgm3SkqavjsRelZJOT6f52mVW+jWN3GmBs1l5btj3vWx04J7MNRH6sL/IZjN2Bh:xrC8ielL3hX1RabjABh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765887492, "uuid": "13b69164-2890-45cb-937a-bdf5697b70a0", "value": 118716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765887492, "uuid": "0b02ef58-c0c4-4f9d-a4c7-f02aa732df2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887492, "uuid": "6a88da63-39a9-4519-9713-89925fcd786c", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3c2a54-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879657, "uuid": "2fe34a63-5062-4f01-b424-4ad8a610e9f3", "comment": "Malware payload (Rhadamanthys)", "value": "3e4e149828e8d8fb6df49cab89885b25", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879657, "uuid": "c4556235-ca9b-4b5e-89fe-19a97be45fa6", "comment": "Malware payload (Rhadamanthys)", "value": "6b190bb4dffc3f7c9e6fe94d0438d62bc1e6240a5ece5b58ef910d453b2b41be", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879657, "uuid": "a6a64ee8-3c1e-46fd-abac-d52e23d13ad6", "comment": "Malware payload (Rhadamanthys)", "value": "2d9e4359552b31abe40b109338d3127256e83f25", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879657, "uuid": "17779b88-e3a9-463f-a421-9bb23a87aed0", "comment": "Malware payload (Rhadamanthys)", "value": "3968f8758b40c0897936ddeb45b9669b3b1579e13a314a1f8748bdafdfc6981df82c0a66ec7c028394c9899c06bf30ec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879657, "uuid": "799f4f60-b27e-4ef0-882b-db6b5c33283a", "value": "T17DA3F830CFAB2CA776EDD6709DA225299E8F442FCB21966E348F77650005739381D6E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879657, "uuid": "cf01e6cd-3033-4aef-84ea-2f0888d63948", "value": "768:GDhd0i7J4sYKgY/CMNfWdAz9JWrXrzroDhKHuxAGMheSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20DrfroDhdxAG4e6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879657, "uuid": "06430c3e-4216-4195-8b4d-18f71fdc6fa0", "value": 98759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879657, "uuid": "43ca6829-71eb-41df-b511-fe4efdce9dca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879657, "uuid": "84d7c91f-e827-4f29-bed8-e7c7b9ebd1bd", "value": "invoice-1637482117.pdf (62).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ecda96-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765895935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895935, "uuid": "becfde78-f339-4571-825e-6ee983619ba1", "comment": "Malware payload (AsyncRAT)", "value": "2fae222570387767e8554587c5858463", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895935, "uuid": "ab2ce406-858e-4755-a6d1-77e553ce4043", "comment": "Malware payload (AsyncRAT)", "value": "6b38fe187c153fa7a549585895b5f1f7eae01d195203a61cd932865cf13811eb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895935, "uuid": "74122d3f-d524-47b6-ba2b-1110db80e7c4", "comment": "Malware payload (AsyncRAT)", "value": "d6570e73d5a26ad01a3e98ae7c05bf1b780706b9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895935, "uuid": "aef92087-3609-48bc-86c0-8c176871f60e", "comment": "Malware payload (AsyncRAT)", "value": "ce8312ef8850bdc76ee47ce2dde9feffb8e684a90aa02b8912b45ee8fe97cff2eac6184a8728c150484ce5a5dff42033", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895935, "uuid": "544b4e85-e898-484e-a005-87366ed00062", "value": "T15A261248E61D0331F3B9238ECA865D00E4DD4509A8070DAFF929B3D5AFE6DB9B557B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895935, "uuid": "cbdb9314-707d-4cd5-8b99-24286d1230e4", "value": "98304:8wHBGYwAsYpUYEXrs7z2rGpuNauZATPTjo4e6CQBLRRXnLRiUro:8wHBGYwAsYpUYEXrs7z2rGpuNauZATP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895935, "uuid": "32c80eaa-72cf-4356-9845-a4a49b1bf521", "value": 4521706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895935, "uuid": "b46b0b3a-57e2-43b3-bfe0-efc88347a6ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895935, "uuid": "1e3053ac-15ee-4d67-930e-58a4be044a5b", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d152e31-dad3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926285, "uuid": "e0f2ceda-04e8-467d-9154-893b83893930", "comment": "Malware payload (Mirai)", "value": "6175279834a2ea2db800e623f21b25bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926285, "uuid": "30b5b5cc-5b2c-4fe7-a4ff-2cfe23a5e8db", "comment": "Malware payload (Mirai)", "value": "6bc551fe739c6be250d89cae952a545987f771000f61eaa00983771e702a4bdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926285, "uuid": "2871dd52-3ab5-4012-b79d-cc9006ec5fe8", "comment": "Malware payload (Mirai)", "value": "8a1b82d319e9766c2306adf89fcae663a3e6e09e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926285, "uuid": "c521bf16-ab87-49d4-8936-c7bf4e058076", "comment": "Malware payload (Mirai)", "value": "0388ea42ea458190a676566491bf8aed9423b34b022c9b050043cb3ba330bb9e9607c46c7896b16a43c6eaac914f5188", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926285, "uuid": "ba53506e-aa1c-42e9-8016-6df0ecd1cf33", "value": "T185A3E665BC41DA16C6C066B7FFCE83AC33165398D5DEB207AD14AB74B78B0260E3D846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926285, "uuid": "c052637b-6946-49d8-8822-6dfc35c45ae3", "value": "1536:glczWw1qh1zJzzo7cBuAL0Ko2wHBRcV7K40CiPkDq8nXhVR15:q6WhRRE4o2wIVu40/Pyq8nXz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926285, "uuid": "0cabfe4a-939d-4f10-af40-9daac3090a53", "value": 99504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926285, "uuid": "dfa0baa7-7372-4890-89a0-bacbd7d27ee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926285, "uuid": "cfd8181e-925f-46f5-8110-58664664e9e1", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328061fb-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1765896042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896042, "uuid": "8d4c77e1-f17c-4b64-b9bb-b170183b22a7", "comment": "Malware payload (VIPKeylogger)", "value": "2c29c7521f5e4d146dd8954721c9f253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896042, "uuid": "03d73578-9126-49ac-8007-4d246d8b84f3", "comment": "Malware payload (VIPKeylogger)", "value": "6be405e0055f40676358755c7316462b67c06f3a53d3f0a09be9a71f4bade370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896042, "uuid": "5dad895d-068f-428f-b37e-3f65f76d7cfa", "comment": "Malware payload (VIPKeylogger)", "value": "bb11b68d9cd64afb020137c053b250587175684a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896042, "uuid": "1b6df49a-93c8-4705-a48d-94e11f6042d9", "comment": "Malware payload (VIPKeylogger)", "value": "9467be94dea14145de09e891edcfe24badd981560838e059f0c8d50b6d359b2274742dba779a53a957b10e23476f4455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896042, "uuid": "d7892a7f-c6d3-4b58-a92a-c5c4a1dadde2", "value": "T170A4E03B322D506CC90B263269ADD0767BA46C5B4B32EA52AF767EDF59F03140A0DF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896042, "uuid": "dc9d5502-ef62-48bf-82de-eae8f67a9cb2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896042, "uuid": "024f4881-f742-4a04-b354-bbf58c1746c8", "value": "12288:vY9ZVDPlIWRw7MSJScJmuK7akkteqX8cCX8Y9:vY9TblhRw71JwGrLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896042, "uuid": "803657a4-2100-49ee-be23-edde835f1402", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896042, "uuid": "cf1efd39-e52b-406b-ae14-fcb73286f985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896042, "uuid": "eca178d4-53c7-4f06-8bd8-5c62ea13e2c9", "value": "transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2594db87-da70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765883565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883565, "uuid": "f3cde894-c048-486d-b94d-b7db3f90ff56", "comment": "Malware payload", "value": "43b8e1ba5e5bb6cea6f030dd46264860", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883565, "uuid": "7a76653b-6702-4194-b26d-b109c8f40c2d", "comment": "Malware payload", "value": "6d450659d857f16d7df7572f8e6cd3f066eac0f2b2b7f90ef4e077097ccba65f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883565, "uuid": "b5aadbdd-9803-4514-b0c0-219848b73f2c", "comment": "Malware payload", "value": "f2ca4a5dc4251dab864993cb262efc27254ad77f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883565, "uuid": "bf678cf0-e4cc-4ce8-a87b-5985c76c9737", "comment": "Malware payload", "value": "54d18d6caaaf517c0697d04796eaa347fe7dad6c4683cfc21ccc77091cb968f40c17084aec34ad8eacc867b48441edc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883565, "uuid": "11fd98a7-03e6-403d-9618-4f2fbd6da9ad", "value": "T1DD6533DA009019A39115283BA46A7BF13F212D6B2B3638582D97FEC7CFB80E54D597DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883565, "uuid": "3388839b-c4b4-432b-ae47-abb273cfc973", "value": "24576:nAHgTVEYTG8g9dnGU3XNqW+E8C73G+xY3/My4c763Gheij87uptkuLpIXEfsxW:n2E5g9hbXUjHQ3G33Uy4+zj87rcpIXEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883565, "uuid": "ab8a9646-e743-4d2e-a15e-8d6c7587daeb", "value": 1426144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883565, "uuid": "b3e17c4a-3c7d-4579-a282-1f85edb300f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883565, "uuid": "affe26f2-c3c4-4038-9c10-0fb5a88c9f01", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed8d5f9-da18-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765845784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845784, "uuid": "e4fbada6-1ae8-4108-9930-036693baa5c5", "comment": "Malware payload (Mirai)", "value": "46c9441ee73d8a2cfe7f0eb8013947d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845784, "uuid": "3ede8bb8-287f-43fb-ab8c-1727b04d55eb", "comment": "Malware payload (Mirai)", "value": "6d9c66e822955183a409ff19b7153531cf495817a87707779b3875f5572a20d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845784, "uuid": "5bcab4ec-8912-4d0f-af38-c36c08a0be90", "comment": "Malware payload (Mirai)", "value": "6cd9e0e7e4b1bab94263505510fd61a7cc521819", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845784, "uuid": "6286a9bc-f213-48c5-a44b-27065c63029e", "comment": "Malware payload (Mirai)", "value": "36297ebfdbf1ec4ed43ee569e9e19eeb086adaee82018076546912c2c9570bca547546a501b05dfa6d60a29200494aba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845784, "uuid": "8c3d65ab-447e-4fc2-a478-ba8788e574af", "value": "T11FB33BE496C3E2BDF8AD0532A0719F335634F9BE045FF683EB60D931AC266058605B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845784, "uuid": "f74f7072-9708-439b-8b8f-9525c9ae4eb5", "value": "3072:2S7TXIzvtjfHtFQ0WhKCLl3x8goDBI7IIy1J4ss:2uT6JvPQ0WMgo9Iy1J4ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845784, "uuid": "181d6e78-c5d2-4581-814b-75b11d29888b", "value": 111696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845784, "uuid": "71048114-d1ff-4d17-8b11-1157f90ec9c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845784, "uuid": "c82acbd6-d415-456b-a680-bb1158e469a8", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7322c2c-da6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765881634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881634, "uuid": "12c8b889-a457-4021-b316-00a85b5e4c16", "comment": "Malware payload", "value": "cd372f494c9ba6c463e9c68128006963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881634, "uuid": "1cb61128-a080-4f18-a583-414e53578d86", "comment": "Malware payload", "value": "6da7fadf5d6da929cbb73124accf870c1a4a99b40a38328a0431a0598577f8df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881634, "uuid": "0018ecab-84e7-49e0-917a-8cbb33bd456e", "comment": "Malware payload", "value": "c6437409e8f05ec0d3584ee06e4730875d9c8f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881634, "uuid": "40736e9c-2872-4c7c-a299-e966c3049957", "comment": "Malware payload", "value": "b095e387af88966f6cb7203ae6652cd5f89770b229b9581cdec85105ece14b37e11a9e9de05301bd3c626ec8c3bf4351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881634, "uuid": "82b19980-0d4d-4529-8952-8178717f6238", "value": "T1F285CF21F2408837D5B33B7B4C6B85D5A875BF441E34A8CF2AE93E0CAF797813965192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881634, "uuid": "84933095-1e06-4382-a315-9aa682ef5bc1", "value": "4c1815698238f00660e079f06b08b15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881634, "uuid": "24062d3b-b841-4d70-824f-c6f28725b017", "value": "24576:WDYoP1JgW1tQ2IXUFTBVx2S8lsdu1Hy+mWdyYoltCCiTCJwNOBwh7saZ8wifw0IS:WkUQIF2AaHTC6OBCsaZFiRIXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881634, "uuid": "6fa135fa-81f2-40de-9ae2-12d4a4438b2a", "value": 1723392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881634, "uuid": "243f4c68-f032-4fbc-9246-d3f68adeeed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881634, "uuid": "2e968d1f-e6bf-4a35-9c17-0b51acfc1c6e", "value": "update.bruss.org.ru", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61a90b8-dacc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765923348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923348, "uuid": "df18fc16-3f57-431c-9b23-92a81af149b1", "comment": "Malware payload (Mirai)", "value": "d90ba76aed70a1e2cbbb0ab7a130de09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923348, "uuid": "2d634500-6cd6-4fd6-907a-48784eebcf75", "comment": "Malware payload (Mirai)", "value": "6df6c474e07e0933173e44adb9434781766bd121aeed0b78157f4a031894fb13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923348, "uuid": "fc391c09-0e26-41a4-a806-877579dd96fb", "comment": "Malware payload (Mirai)", "value": "6617481e1d80cc2e6502e0c277df95e9580ccfdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923348, "uuid": "fb419313-7f46-438b-848e-59e8b45c81bf", "comment": "Malware payload (Mirai)", "value": "3127bf7f727e945c1fd29c630ddaa1b5aaf6dc692e02428c858c3dd4848cacbedbceabc7bc9ff5376d0ed6f6310b7561", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765923348, "uuid": "9b28968c-92b9-4aad-bcc9-a6c6e74ec81a", "value": "T152C3B5087B910FBBD866CC7B89980B49188C640372B93B757974E914FE4E29F4AE3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765923348, "uuid": "cea30f3a-9bf7-4179-9595-84ceca0f7736", "value": "1536:ssNrzng3rEAN5ysGVjvntTVMqPkY7gQ4E6MLtxJfijp8nF5JnLvGgmxxHA:ssx5A/ysG9ntTVMikYvqp8nF5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765923348, "uuid": "24dc4167-4680-4e8b-acae-24f63a1562cb", "value": 122020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765923348, "uuid": "3e812c44-ee08-422a-a40a-a521980eaa80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765923348, "uuid": "fe1bfab9-a26f-4441-a5c4-ea7ab8073926", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08da09aa-dad7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927754, "uuid": "457f4d15-7f35-4940-a142-3082d8f29c57", "comment": "Malware payload (Mirai)", "value": "2aeb0048957d6179d7bb86dabac8983e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927754, "uuid": "1cb3112f-263b-43d5-bfca-c043a8631738", "comment": "Malware payload (Mirai)", "value": "6e1e065bbf5d3cde4b9b6d7ff94dcf308568f17fe990cc25daa986c1f6d741f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927754, "uuid": "c1502e0e-5704-469a-9279-a7e5d20208b0", "comment": "Malware payload (Mirai)", "value": "a553a67619668055060caaf0dba1ac50956fd2cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927754, "uuid": "5f641d20-39ec-4b4a-82bc-a0b3672295d0", "comment": "Malware payload (Mirai)", "value": "338debb6c7c276b2e0d4774058093df8b1f7a70f3a461119a022f8c373c179d2560e8e594a193aca754682d5bab99f3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927754, "uuid": "dacc0466-369b-4d84-8fbd-a276d118a826", "value": "T16CA3F759BC44CA56CAC466F7FF8B439C33168398D1DEB207B958DB64B39B0260E3D846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927754, "uuid": "69c2e86f-720b-4830-af22-657ebcdd4a26", "value": "1536:lJBEbeH85dHCDzzNBYDhLAmvYFy2AkHtLRA0qs+58qX0SDG8nXYVR15zr:lX2XdHCfZgey2tLRAtskX04G8nX25zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927754, "uuid": "e14e1778-e206-4b4d-b895-47618d85b526", "value": 99504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927754, "uuid": "b2e9d58f-2e9f-4792-a614-fff1e1f9ee9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927754, "uuid": "12264fbc-8de9-4cb4-8563-86a80ca9dc47", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc773a94-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879952, "uuid": "4723d89c-2ec1-45da-8105-38615db3dd16", "comment": "Malware payload (Rhadamanthys)", "value": "b4bc622d0ba48ed31c2fecc84d3a77c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879952, "uuid": "99a2f5b4-aa63-43ee-8810-e995cf5da3ee", "comment": "Malware payload (Rhadamanthys)", "value": "6e3300ef24f9917ecad8a437fc66acd323cf72a31e976e53be837d0cdfdc6895", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879952, "uuid": "455e0c6b-c722-4618-843b-fcc77ab19c6e", "comment": "Malware payload (Rhadamanthys)", "value": "566c9ace90c6f57d38c49556dd62c50b36e72e21", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879952, "uuid": "7e55d74b-bfa4-4bb2-b183-ad2049d2f272", "comment": "Malware payload (Rhadamanthys)", "value": "18354f16864e73ad81898d354d70504f9ebe0a1295582df7a960c6b59daab7d82e3518060a781bb282d7996362ca9d96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879952, "uuid": "6f014a7a-8d7d-4398-b0c8-08c96b0379f8", "value": "T164A3F8CD3C61ECF650D690A36E0869B5F80F41AA1A55214989CF777B059CBE23ECE1CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879952, "uuid": "dff263b1-bd23-40f0-af3f-18d7337c1266", "value": "768:GDhd0i7J4sYKgY/CMNfWdfd3BrXw+rwVIfNwH5y7eQ1AwP6WCC7oQESLAuAAroQD:GDB7eKg20nrdrwVs0sA0Ty6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879952, "uuid": "ff8b59a2-2054-42de-a5fe-f5fb8f31cb6e", "value": 100737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879952, "uuid": "24d4b8fe-ad5e-47ff-8f0c-85f8f80d77da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879952, "uuid": "44728ed1-0718-45e6-ac4a-1567acf5bd82", "value": "invoice-1637482117.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1163a79-dac5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765920359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920359, "uuid": "eb44e59b-c552-4890-9ebf-b89071cde1c9", "comment": "Malware payload", "value": "7f34560216d2d553931a1705a790d7e2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "Wacatac.C", "colour": "#0CB4A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920359, "uuid": "b9d067a5-95bc-42d8-ad70-a9ebfbcc74ab", "comment": "Malware payload", "value": "6f0639714b080ffd89d082c080e2715e198536dc63ffda5aeadcf72406d31ffc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "Wacatac.C", "colour": "#0CB4A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920359, "uuid": "e7f0d2b0-a69a-4a14-b6b4-821df4d3016f", "comment": "Malware payload", "value": "a2ad4235fb28250340b86659cc8f4fd0d7205a86", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "Wacatac.C", "colour": "#0CB4A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920359, "uuid": "b9d42842-8993-44b7-925e-decdfd0d532c", "comment": "Malware payload", "value": "334f75be001cbbe0805d5443909584cf8077fb17deeb803c38959e7c25db96fab87d66b3b2d64b1215363e8ad4a1d46c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "Wacatac.C", "colour": "#0CB4A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920359, "uuid": "d414b5dd-953c-4b5d-a8d3-177d633b9bca", "value": "T187961212B687C432C59D0177ED68FF6E1538BEA3473115E7B7E839AE48B08C153B9A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920359, "uuid": "cbdecc5e-9c60-4394-9efb-a8badb2b4acd", "value": "196608:wb8l5WiATvfHCQ4Uy+K819J7h+gQ6qBjtDR9DUnlveDQQ14rl:wYDhATv/jc+7reBRDRlAHAal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765920359, "uuid": "96807c65-e6c4-43bf-a69c-641c5a5b3945", "value": 9414144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765920359, "uuid": "7ada38bd-5df1-4749-b643-7fe3d2120915", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920359, "uuid": "42170a43-b88b-47fe-befd-3f4d06fbb76f", "value": "ChromeSetup-6808.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1247108-da1a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765846835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846835, "uuid": "f28d074a-9dbb-4bdc-88f8-23a89a1438da", "comment": "Malware payload (Mirai)", "value": "f81974f802b01127d078c38cf74181e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846835, "uuid": "aa3e99e1-e919-4436-8ac3-32646401bf16", "comment": "Malware payload (Mirai)", "value": "6f24746def4cddf64b680b299d973e4455fcd7a6392f26ef3c4a6dea1a2937ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846835, "uuid": "38fb04fa-8fa4-4980-9044-37472aa7dd1a", "comment": "Malware payload (Mirai)", "value": "b15247be81710cc6b35b9574a28b801c2f94c6dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846835, "uuid": "e8688c4d-351a-4627-bfcd-392c897e2393", "comment": "Malware payload (Mirai)", "value": "0896ed7308185d3f9d07caf4618920f5d0f750275d3baa7e95b0bfcf25c1a03a837a7766b1165085a63173ad31310588", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846835, "uuid": "adc016d3-ba45-4f87-b79a-68cc1fda36b4", "value": "T12B932A63CC656EA8D628D5B4B0B08F792B639510814B1FBE5667C3758443DCDFA0A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846835, "uuid": "0593bfdc-fbb6-4f61-a711-61d98aaa2ac2", "value": "1536:Bq3+zxHzb2kcCLyipbO7WDM1oaK4vrfy26vy5s:BpVHzb3ctiJO7WA1o94+y5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846835, "uuid": "f9df5436-b075-4461-a9a2-8077c8446e21", "value": 96688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846835, "uuid": "9d93dd68-90e9-415f-ae46-8d27754e5396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846835, "uuid": "e6acf7cd-daad-4d90-a321-c3a7755827f8", "value": "nuklear.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdd59a5-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765896381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896381, "uuid": "76126a63-90e2-43ae-b327-b10cf6b4a013", "comment": "Malware payload", "value": "d1176d823c38b815691b1d9337be407f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896381, "uuid": "80b6ad87-09d4-4fca-afda-91663e63a534", "comment": "Malware payload", "value": "6f49fb94efd27f1f8adaaeef423ec5dfd2f20bf59df4d2f686b657f98c95b192", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896381, "uuid": "75189edc-13d2-44e2-8963-9e77d3b9c0df", "comment": "Malware payload", "value": "a218a3b868d507b2c70f5a55356bd2f412c5d4aa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896381, "uuid": "40afcb1a-ad32-417a-a498-1efd983e3c4f", "comment": "Malware payload", "value": "2bcc06c1176bde3d0ec93e1f25a07fc85d9f657ae0ed212d3549766727b4558a56930ef03ce3ad3188c1db64efd3fc86", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896381, "uuid": "a11ba61b-83b1-43b4-a21e-b717b233337d", "value": "T167D4DE7C1DD5107FADA4BA6D619632EF6E8D1F840B10EE0E87942CC17216BEC287E671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896381, "uuid": "d05295f0-3ef2-40a7-bdc1-8f2656448c91", "value": "768:dMX9qOSfFmTNYibyWeru/Use6hXuT3ES/xuLYjTKE1BamQsUc8f:uX9qOSfQTSiWnCss0TlkextUcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896381, "uuid": "da4edd49-bd27-4b5d-8631-b0f1d430ee79", "value": 636547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896381, "uuid": "65205e27-efb5-4583-b58f-d94c4ed30ce3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896381, "uuid": "1835a22d-75cf-433e-aa16-cb7d27ad97ea", "value": "ShipmentRe eipt_70985643468.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ecaa25-daa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765904820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904820, "uuid": "74f774ff-75cc-4877-a8af-efaf94599048", "comment": "Malware payload (Mirai)", "value": "ebff8d908fe08e5cfa02541dedcaf2dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904820, "uuid": "ab5d38e9-5f8d-4aea-af42-b10e7530029d", "comment": "Malware payload (Mirai)", "value": "6fa41406c5663fb0c3e4ba3eec9acde0d9a3a8d69af2c0ddf3959d8949794ac9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904820, "uuid": "058acd26-762c-4d47-8337-0e3895b51ea6", "comment": "Malware payload (Mirai)", "value": "1033ac69d5a1992727857e0cb725e41c13ae2b0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904820, "uuid": "7c7a06e3-ff1e-44ad-9f1b-63457ac8e447", "comment": "Malware payload (Mirai)", "value": "d3f77604bd9ea67556b34672f0f3f3ef4c04a2d242771a53867452863f8417f25ce906030ffeab5dd5b8afd7002c6e15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904820, "uuid": "624bded6-92d0-405e-a428-0a6dc975d740", "value": "T174B30715BC419B26C6DB37BBFFBE029D33166394D3DE710BA8205B55B39B01A0E3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904820, "uuid": "37dab9b8-b914-46bd-84e1-d5da19e589e0", "value": "3072:rZXcb+O2XRIiduTfD5B4Aa/c7Ew28n85:rZMClqAuJB45/c7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765904820, "uuid": "4015165a-82f3-44c5-b3d4-77f4a2637226", "value": 117360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765904820, "uuid": "480baaf6-b0a5-4d37-a787-c5a16c80b606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904820, "uuid": "a26f7020-6e9f-4ef2-83cf-4d53c6467459", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdfb2ce-dab3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765912648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912648, "uuid": "e3eec61f-e3f0-4500-8df8-a11ff6d0a59a", "comment": "Malware payload", "value": "ad48a1273350511296944b812270657e", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912648, "uuid": "255fcb1a-33fa-4199-b1f2-d36a0173f56b", "comment": "Malware payload", "value": "6fb770924c7dea4b2392f523ba8969abdf17624f10911772eb54e338e71aaea6", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912648, "uuid": "c1a29769-2002-4434-a61c-08977806a198", "comment": "Malware payload", "value": "1c26dead9faeadbff622a6e3fd29a3788cee2fe4", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912648, "uuid": "d42aefe5-310f-4620-b507-665245c83513", "comment": "Malware payload", "value": "56329a9ee52ffd977693919e5efd9406af1000ebc1ece2376927ceb57a68a4f78514197ae81cf7a45c57ed229b461d15", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912648, "uuid": "8f65ded5-5fe5-423b-b17c-10ea344b7f41", "value": "T17706331CB89F448CF41F887D49FE95AD4726B12739845ACB863F6B36345AD006AB7383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912648, "uuid": "8e6c954f-3d76-4407-a4f6-a58c26a3e7ee", "value": "98304:XVtjtRyc4qbLzgXxX6cNO2z9GwUe8EL/uG0z/:Xvjtb4qf0XxX9O+9dL/u3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912648, "uuid": "96893532-ee44-48fc-913a-a927e90c4f5d", "value": 3961709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912648, "uuid": "3dbbce62-e493-49b7-96fa-45de7487c093", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912648, "uuid": "dbf9d8e4-c188-47e7-af3b-1e1264226de8", "value": "0001-59_71318.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4b5d12-da7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765888352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888352, "uuid": "a4837cd3-f867-4c45-b392-75afca86cf81", "comment": "Malware payload (Mirai)", "value": "08591e877a72f66a5bb4f99bfb211d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888352, "uuid": "7cd97627-b785-445c-8aac-02f4011af1dd", "comment": "Malware payload (Mirai)", "value": "6ffd687fa3d80f61ad76a5e47a81bdc899eff82427085d5dceae01f3879b3915", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888352, "uuid": "baa34098-935f-4588-909e-4f1efc350b0a", "comment": "Malware payload (Mirai)", "value": "84e3ec29f88323dcca3df518be72f750f2040e00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888352, "uuid": "6d73fe7c-c761-4b3e-8407-84561f81788d", "comment": "Malware payload (Mirai)", "value": "d81d54c9d92656dbe68bfcf536f3f2b68d567f37b7246a20608d485aa4f24a2f12371051099d6a21646d4fbed79ae1a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888352, "uuid": "9e9a176e-b003-4658-9a74-d2952a53f91e", "value": "T1E2F3A60E9E315F7DF2ACD3B947B78B20DA69129227E1C970D1ACED005D70319A86FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888352, "uuid": "2ecc3f4a-1c50-4937-8b8e-cd440ccc5c18", "value": "3072:cbQiMKFbhWI6w6Qxof5C+zyHh1bii/Sw0r7K7Ror4+mHPvg/54+6sw73tBr/DfpD:c0iMKFbhWnKoiOEy93K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888352, "uuid": "8d5a9104-b1a0-4605-8b9e-719cb7a289c4", "value": 159672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888352, "uuid": "58800606-2b0e-4633-881e-32ae6cbe9ddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888352, "uuid": "166c2040-6b68-46f4-97e7-557af251356d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1acd31-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883176, "uuid": "b5334e50-0881-40a8-b230-4cd1dd18b8fd", "comment": "Malware payload (Mirai)", "value": "f7b9cd83b0ad31d5219b4a791b590d15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883176, "uuid": "5162c84c-f105-4b25-b943-550c46151e38", "comment": "Malware payload (Mirai)", "value": "70826bca288adcba9ae07bcefa90c39ae952dc88028d91bfd16997d98732a696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883176, "uuid": "8a658887-7520-4895-b86a-9e025b77acc7", "comment": "Malware payload (Mirai)", "value": "e29a671deb4021879677f471649b69eeebcb96e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883176, "uuid": "446c6f61-778a-45b0-a13d-1c0ddd7fe556", "comment": "Malware payload (Mirai)", "value": "18e2f66bab4d17ac7dd5de37f2dd65c81a6c95e7ec33e28f0e2e9e40fd25a5d1b706308ed59cfe2b0c508c16000a9f8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883176, "uuid": "1d3a8f70-2df4-44fe-9e0c-c4868c4b9ff2", "value": "T15CB32822ECF73D37D0D474BB61C38932E56A470814B89A19FDA10DDC9F2F524276AA72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883176, "uuid": "62d6f9a4-6d5c-404b-8494-5d4cfe0e844e", "value": "1536:WkZegsVWOr2Id3w15QXgG6Ya431txFiPjQ82t92qm4iAJ35ujNMuhABHiP:hkNhdjbfVD2qmjBjNIBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883176, "uuid": "d29c15e5-bf20-49a2-a346-077ef6fc1342", "value": 107844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883176, "uuid": "a2c8b441-c177-4965-9ff0-9f787fe462d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883176, "uuid": "a1bea9b2-47d0-4f08-aeca-433feea0c34c", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3df3e54-daa7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765907506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907506, "uuid": "2aacc5f4-f8a8-4c47-ac66-8db5f5e5b909", "comment": "Malware payload (Mirai)", "value": "b0ede0da3b9911c72383a2b8cb63c39b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907506, "uuid": "f7dfe10f-8929-4620-b404-28796108e6bf", "comment": "Malware payload (Mirai)", "value": "7085c9f096394e33823823a482c5a4fa5994192db2dbc17e7d2308e95be87aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907506, "uuid": "90fae982-3f77-40ad-91a2-b9a0e9bbbe13", "comment": "Malware payload (Mirai)", "value": "3709bf72393c22d52c04a02eff8986f4a7622eee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907506, "uuid": "615ed1c3-a131-4e1c-9ba2-7aba2f3c61f9", "comment": "Malware payload (Mirai)", "value": "53aa29f3ad6619c7ed527d7d16b63772c2e76aaa902554c5474506630422eca0ab9ee3b26e5cf06d5458cffe650b44a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907506, "uuid": "53c10a1c-c396-4f82-b2e6-cfa7369ae90a", "value": "T14BA31959BC418A19C7D06677FF8F039C33164398D1DEB503F9286795BB9B0268E3E886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907506, "uuid": "5902c468-d3b9-433e-b5bb-d76c9f9cfe64", "value": "1536:V6Fr/lA67p1xOhzzSkDexPoEfI1HG+qO2dPZr51UlLpvg8nTo5:V63T7pPO5OkufyHF32BPS5g8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765907506, "uuid": "f2b0cce7-3911-400a-bd85-e3ce4d9bab91", "value": 97968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765907506, "uuid": "f98b2869-c21a-4769-b0fc-6cc35a57acb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907506, "uuid": "fe890673-5f5d-4c92-81c7-5380605e5584", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2cd9cb-da6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1765881775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881775, "uuid": "f27b2220-c16d-40e3-9456-21f0cc227816", "comment": "Malware payload (Adware.QQpass)", "value": "78a8a1c9fdf5779a28c581d97908079a", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881775, "uuid": "695c12d9-6470-4def-bb53-f1c1e0f5ea81", "comment": "Malware payload (Adware.QQpass)", "value": "70936a7ded2bf6c07a625459583d8ad4bf36258002235ad2f81db9158b3aef6f", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881775, "uuid": "605734a4-c640-4b23-80f7-9e8c2e7e48ed", "comment": "Malware payload (Adware.QQpass)", "value": "03cf511778fe04e5963b62e81a4cd0562bbc448c", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881775, "uuid": "617f8ff3-092d-4a8d-9d57-8a41a4cfb43b", "comment": "Malware payload (Adware.QQpass)", "value": "3807b5c9b7213a1560b1aa907c98e924019d0b26ba0970f8f93a0bb2c49b23bf82e988164de268098294ccd018004f19", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881775, "uuid": "264c5eda-79c7-4d25-a608-34d1eddee288", "value": "T1271633FA98DB8BBEDD3F6A3905270E70823D245C7459B01CC891AE95E6FC40B7EC2654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881775, "uuid": "98726323-272c-4c70-9015-7d0220be179e", "value": "51a854d285aa12eb82e76e6e1be01573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881775, "uuid": "42227295-6173-43b3-b90e-1bd54b551eba", "value": "98304:c33FDrkCh+bQuqVKqHDR7oY1Upw3DkHrzihJG5aWxLm:cBVu8K+DO9w3M8J0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881775, "uuid": "22bb72b6-33c5-4fb6-bf12-967af5c39ebf", "value": 4241962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881775, "uuid": "79d119ca-4a86-4f27-ab14-da0ef8ac4699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881775, "uuid": "a6998573-e07a-4685-b52f-27f9557e3617", "value": "47.98.224.91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2335b23a-daa5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906324, "uuid": "7c731e0b-c311-4214-8397-cf43b6b8f0e6", "comment": "Malware payload (Mirai)", "value": "8ce84e3bb81e97ad6d8ff0d1fb5ef2c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906324, "uuid": "090f68c7-420f-4eb3-b65d-e7fd581c3422", "comment": "Malware payload (Mirai)", "value": "70c328dfb193b0b0f5f1d3fafd7baeeb60e37018b335668c36e229309e35811c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906324, "uuid": "7f7594c0-3c1b-4253-92d9-110f0620360d", "comment": "Malware payload (Mirai)", "value": "f96db612a04203f34b4e8f8f10a657085824e29c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906324, "uuid": "ee8ba9ae-3e98-4482-acfb-b55754524aeb", "comment": "Malware payload (Mirai)", "value": "66ec5cba225304a994719b7e48a0a4dee313419aef3dbd437bf434d3eaa30d4722afdbcd538ea74d6fd630c83b4b78d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906324, "uuid": "78caa62e-fdb5-4d3e-a948-f07846191f12", "value": "T198A3E551B882462FCAE123BAB66E128E336177E5D3CE7127C8614B213B9551F0DB3F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906324, "uuid": "b98efb4b-021f-419d-a46b-beba902c6117", "value": "3072:Ctm9PWtI2gdH9kol84d2yP79AhkJMbT9:Ctm9PRB9Rd2yPhAhkJMbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906324, "uuid": "4c90b126-7b0d-493f-8f7e-8e438c8fbb46", "value": 106768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906324, "uuid": "4e5e177f-0349-4180-98b7-2d3c20c31b01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906324, "uuid": "cc082fdf-c458-44ab-a7fc-12cd2ed66a8a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22739a64-da8e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765896444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896444, "uuid": "8fa94ea9-3e98-47ba-896f-923f6f74d3c7", "comment": "Malware payload (AgentTesla)", "value": "a384bbcf644d34e1465304b2b91c5527", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896444, "uuid": "a2786a60-ef53-4660-8ef8-8e0b5315dcd0", "comment": "Malware payload (AgentTesla)", "value": "70f19be162bbe925f2d83a83426e7d3558e0133b1653592d75af8ef1fb9d18f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896444, "uuid": "464b4a22-2bba-4e43-a42b-e02d6bfa05a5", "comment": "Malware payload (AgentTesla)", "value": "0b46ffbf9912d3600991cbb9cd87f1b5c445099a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896444, "uuid": "126cfe7e-b19c-447d-a8bb-a7ecc840da6f", "comment": "Malware payload (AgentTesla)", "value": "20abff86a30bd85331c9461f8882f0c483eaddeadad00e7122813076c19bc22faf2281370bfcaa59c31438b615b869c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896444, "uuid": "a01df1e9-d14a-4026-bc46-ec63463e0655", "value": "T1A7D44A20DD2416A94F071BA9FD541F61CAFC960A552A90F1F6DE070E61029FCE3FE6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896444, "uuid": "79107be0-b990-418d-a25f-f75a235905f1", "value": "12288:sKTK4KlJCIKlJ9PKlJg+ISKlJg+LKlJg+IbKlJg+ICKVKlJg+IZKlJ4KlJg+IaKn:sKTK4KlwIKlbKlxISKlxLKlxIbKlxICS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896444, "uuid": "2cc925bd-41d8-4bc9-bec6-8b3b00ee7ecb", "value": 598543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896444, "uuid": "85a5a058-bcbb-4ee0-b4e1-f49cd1f7ed3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896444, "uuid": "577ac554-a7cb-4d03-b6b7-c6c362495b88", "value": "ORDER PI RFQ#0203.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0277943e-da8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765896391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896391, "uuid": "1b9db43d-d662-46d8-847d-aa581c2e163d", "comment": "Malware payload", "value": "cf230d03ac1777311ab5196ab3bdc095", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896391, "uuid": "a6831500-3259-4560-a873-49d5d28b0cd9", "comment": "Malware payload", "value": "71cefbc48936a0c78e45a8f920ec49aeb798b441476afd18a11f5b780261c355", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896391, "uuid": "4626d31e-4b7f-475b-8a7d-04b1ce109fcb", "comment": "Malware payload", "value": "ae0eb4a0b87d043ecbbdcf25b795ccf67dbdc1a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896391, "uuid": "6aff1d94-496e-414c-be50-5f8b58c8515b", "comment": "Malware payload", "value": "372e7c996f6e52b80c444356ab0e8b772c7d37d25d742d9469de2fcd9cb779a7cfa44c34e3258b36bb4a58b921d91fe5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896391, "uuid": "1ea36c27-2c96-4513-a276-f0f8cd1effec", "value": "T18E060424157F268F491313698A8730C5BC8CB0198B1D60EBBE047DCEB7B97E286635F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896391, "uuid": "87889a97-a6a3-4c53-9eb4-634cf798c6e0", "value": "96:ce6J8MpP3lZgFI8gyP/cOSDVaFgRxMTqNenN0iq/7rNcDYPNRcNyq0N4pgb8l3eu:5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896391, "uuid": "4b0bb015-36ca-491f-9b09-2b4f67d14462", "value": 3983773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896391, "uuid": "4430dc7c-1ce1-476a-8997-5bb9ca46f16c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896391, "uuid": "75660785-57a5-4ca9-bf86-a6844b94d04c", "value": "779690-0865.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e95a15-daa5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906325, "uuid": "d2e4dbd5-8bc9-40ff-8e4f-159bfef0bd85", "comment": "Malware payload (Mirai)", "value": "2753a77d50d83c62a7242d55bf834866", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906325, "uuid": "aa1cd573-6491-4878-8c10-cbe58f14f5b0", "comment": "Malware payload (Mirai)", "value": "73e7fe65a9b24a1e88005c846375c97f8837f995a6bbb6fe4127c63236725101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906325, "uuid": "807c6d25-a631-4124-b810-93e7c650930f", "comment": "Malware payload (Mirai)", "value": "5f448a82ef0686291d321f9110e8e5d750fd86bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906325, "uuid": "8e267670-839e-41a7-bb8c-0a66d5f49e6e", "comment": "Malware payload (Mirai)", "value": "30c433c3050275b8f33b97606ca5235990425085917c7bff539292a96666cdca38cd1424876c8867f713788f99a8640b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906325, "uuid": "8ece1f4f-77aa-4012-b1af-430dbb109a7a", "value": "T11BD3D7086F615EBBD46ECD3751A84B4A198C540B3ABC3B7579B4E604FB0A14F0AE3C76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906325, "uuid": "90220d0f-78f7-4db5-843b-d8e542d857ed", "value": "1536:XPvmKz7jTZckCRVPcowlVpXBuXS+o5U1f/P600GPbDrc7B8nTo5O:XPjZckc4foZfgGcV8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906325, "uuid": "1dd71e5b-855b-49b7-a661-daf428f2a590", "value": 130908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906325, "uuid": "c40821f5-1dc4-4b0f-bffc-d0fac856ee6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906325, "uuid": "2587bb2b-b0f4-4ef4-80b1-b7afe6c9c553", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b286ddc5-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879936, "uuid": "9e6aedf5-bc22-4b29-b958-558328412711", "comment": "Malware payload (Rhadamanthys)", "value": "5902e0d16955e3e3dc15b4e0d4ef6b8c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879936, "uuid": "d971c31e-e99d-4b90-8b66-2be309df6db3", "comment": "Malware payload (Rhadamanthys)", "value": "753b3e3fe613df6a332c6e33b966484ea9df6ee7cda6dd6827feb773b0a03739", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879936, "uuid": "4404ee1f-1cef-4d15-a664-ead7c193a778", "comment": "Malware payload (Rhadamanthys)", "value": "098723362ff2b36f797c7d1b0c073f1fe445e24c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879936, "uuid": "2b326662-f7c6-4a56-b395-561ab1855263", "comment": "Malware payload (Rhadamanthys)", "value": "699f69cef60e321dc7e6ac0511300a63b7508d9f09592f358a1ef61c24bcec1c882fdea68a58e44482a41c0fed0dc3ed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879936, "uuid": "4a56334b-2211-4289-8fa2-4e37a9049ce8", "value": "T1AFA31B4ED911ADFB9085BA3C6BFD20A1646B9B8438E1B095CE4F767D44E12D4EF82087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879936, "uuid": "76e125d2-0509-470a-a3d3-eb6bc948a0f4", "value": "3072:GDB7b0Q/ho/x6iIiPqFmWFLsLihSYKhl4qayvYSkpYkgHYSZTamHn8RrHGUGmCjB:0l/ho/x6iIiPqFmWFLsLihSYKhl4qayf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879936, "uuid": "01162a44-0d33-4911-8b4e-4117db4ca377", "value": 101371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879936, "uuid": "e31fde63-133c-46db-814c-6f09572855b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879936, "uuid": "81ee465e-5114-4407-a099-d8f6d6ab3520", "value": "invoice-1637482117.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd65db7-da81-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765891066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891066, "uuid": "58c4f805-d8df-4049-a6e8-011e43246889", "comment": "Malware payload", "value": "167240e640926beba8a5c7ebe3b0cd0c", "object_relation": "md5", "Tag": [ { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891066, "uuid": "33835292-930c-4886-8aad-974d627bb748", "comment": "Malware payload", "value": "7620c2fab8afcf1c00cf29cbc4b3ee30906be383cc13340bea77324ecaf90f91", "object_relation": "sha256", "Tag": [ { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891066, "uuid": "32596965-017b-4ef6-ac12-bc63d88e15a6", "comment": "Malware payload", "value": "976b6c84a8fc479ecc4ca3b87908b771f757941e", "object_relation": "sha1", "Tag": [ { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891066, "uuid": "d57d3bee-3301-49ed-8335-ed7aff81df94", "comment": "Malware payload", "value": "66e513bbcae6ad9e3d58c0dac9e597a205e076ccc5cf6d94c59d8459a58a1264a87958d24e4eebbcd528d50bfa37948d", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891066, "uuid": "1a3fea77-af4e-486a-bcd3-9e953dead79a", "value": "T182118458716DD8CBFB0A7632102771937AB491A74353EA0D794C964A4562A4A16003C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891066, "uuid": "523b9435-dd6f-4dd1-8fe1-08a55f846128", "value": "24:9kqApwdXauEiGYhTNBCV77BqhfK5FTXnGRvEKt:9kqApwV/fTOl0cFTavEKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891066, "uuid": "d317b3ae-265a-4cfd-9d26-9368d237c9ad", "value": 960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891066, "uuid": "97cb19fd-e4b9-468b-a5f2-9629dc304790", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891066, "uuid": "0894320c-aa23-43e1-8823-ce0683f96c6c", "value": "7620c2fab8afcf1c00cf29cbc4b3ee30906be383cc13340bea77324ecaf90f91.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef21d5f-daae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910451, "uuid": "8fd822fd-9bc1-4847-9669-21d6835fb07e", "comment": "Malware payload (Mirai)", "value": "5dc8e8298b54778caf4158e4c7b60aa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910451, "uuid": "2c069130-4517-44ce-aa52-0a300a90b4d4", "comment": "Malware payload (Mirai)", "value": "7643248eca517a9b5a729f3158a00b8e3ce6cdc2bba2588b820f031e4647b3f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910451, "uuid": "7cb042a5-9c29-4020-9777-1f78f3358b31", "comment": "Malware payload (Mirai)", "value": "7a59a1d761c98c09208cb92d4a30ba1fb5fd9ccd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910451, "uuid": "8cc05daa-76de-42e4-a07e-94704292a54d", "comment": "Malware payload (Mirai)", "value": "6b9efcde044cb95cab8901a2cddbb67abfdeb9485ebce7a81e4f0f02954750e6bb95283003eb5277c83ece7204133b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910451, "uuid": "148e7e7e-6e0d-41de-911e-3b543453ef3f", "value": "T121C31A87B3184753E0428EF46E3E27E88FAD695010BEF78E241F660909B6C775449EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910451, "uuid": "5dbfed69-4cb0-4c4b-a4ef-4ccb1daf67fa", "value": "1536:C0EqlwoJB1dwRdNaUcYqLrorAsau5yh3t3VZd8ndo5lZy:DRwRiUcvLHsaFnl8nm5lZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910451, "uuid": "ea5d2031-9ed7-4b31-bf8e-c0bde21b3ebb", "value": 120100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910451, "uuid": "8f0792b8-d35c-4d78-9c46-b3bc6c60e274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910451, "uuid": "8f963cd4-950e-4904-acad-8e7fed747484", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1914db9f-dac5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765920051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920051, "uuid": "e79abadb-7b23-4227-8fa3-3f803aa01fdb", "comment": "Malware payload", "value": "b7d3f57878e195001bf04a74d01b6d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.A!ml", "colour": "#27E434", "exportable": true, "hide_tag": false }, { "name": "Wacatac.A", "colour": "#3374B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920051, "uuid": "650f69c1-1284-40da-9fd1-69d7149a9eb1", "comment": "Malware payload", "value": "77002e7bb780faf9fc93adb49af1272a5d95196aa0f1a26ee57cb27a3930befe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.A!ml", "colour": "#27E434", "exportable": true, "hide_tag": false }, { "name": "Wacatac.A", "colour": "#3374B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920051, "uuid": "798e8619-fe02-49b1-971e-96bca8773615", "comment": "Malware payload", "value": "30fbd5adcdc53e87eccd995414a945ab296413e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.A!ml", "colour": "#27E434", "exportable": true, "hide_tag": false }, { "name": "Wacatac.A", "colour": "#3374B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920051, "uuid": "6bb4c1b2-6dee-434c-a4e4-916648896656", "comment": "Malware payload", "value": "8f6694dcee4eb6db99d266f1a368385676259530bf7bb7ef2c7f74e1c45743743675e888c60e2d8272c7dc560b20c7e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.A!ml", "colour": "#27E434", "exportable": true, "hide_tag": false }, { "name": "Wacatac.A", "colour": "#3374B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920051, "uuid": "ff9871c7-4f12-414f-8f37-cb18c34ef496", "value": "T1FF83F18AE9B9C1D0D8F6A27099B5A339BB71B051C1FD5B36028171570C713A8EE5F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920051, "uuid": "adb65f65-ff5c-4a3d-92f7-731e80a74ca1", "value": "54eaedd7ea735b3354a002cfc3d063e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920051, "uuid": "0b34dc83-fc84-4a62-b771-a5a085a5398c", "value": "1536:15nv0UJe642RSg9gjqV8+1nafyBibdWMzIPFL90B9GEIMarl/euhBBeqek3:15nv0geGR1xfh6cixEx0/zIpguhBBeqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765920051, "uuid": "6bc5ffbf-d580-4cae-a8f5-7112a91dbbb2", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765920051, "uuid": "43670311-321f-4085-aeff-45d5c2abbb03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920051, "uuid": "2f00e555-f43c-4f26-9e73-50c862cefc1e", "value": "2025\u5e74\u7b2c\u4e09\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f\uff0c\u8bf7\u5927\u5bb6\u4f7f\u7528\u5185\u7f51\u7535\u8111\u67e5\u770b\uff08\u6587\u4ef6\u5207\u52ff\u5916\u53d1\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8d9b15-da3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765861539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861539, "uuid": "fd452807-acba-47b3-acfe-e73b657a8ca7", "comment": "Malware payload (Mirai)", "value": "06d13b1a9d87b3dd1a1969e104964980", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861539, "uuid": "1377ec63-2242-41ea-8f4a-68923fdb6382", "comment": "Malware payload (Mirai)", "value": "7792cae13385360dc6b5a302c91e4ba0d439845518d691ff2c5a637b0773866c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861539, "uuid": "83314986-5b31-4551-aea0-52fd03fbb0ca", "comment": "Malware payload (Mirai)", "value": "8b783318d80171700d09d03343ef5c32bfcd734e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861539, "uuid": "39953811-4e09-401c-9ae1-a858503ff2dd", "comment": "Malware payload (Mirai)", "value": "7e09a8bc3f2ba5229ef0629993f39d4466e3d1c1576748478bd808d980b46986d62b4214b76d936938f5eae2464bc509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861539, "uuid": "b7d95b44-7e87-4246-9eb2-dfc3b386a5b7", "value": "T150E3C70AAF910FBBCCAFDD3706A9064239CC651722A43B757674D528F54EA0F4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861539, "uuid": "4e7011a7-38bd-4b56-a1aa-89a52066c3d7", "value": "1536:Jj8AboU6g5nncF6ETy80OIX+c5GkjN3XDTei37jk8wK0NANRLB4g8:JFbO+nIRklXDB3EvDkB4g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765861539, "uuid": "fe19f474-4433-49f5-a9bb-4c223c99e890", "value": 148448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765861539, "uuid": "d7384c4d-6aa3-4aa3-8d32-75789c216db5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861539, "uuid": "31e7132c-c006-459b-9e1f-86e4b919d9c1", "value": "nuklear.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6e51a2-da88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765894157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894157, "uuid": "dd999a13-1ba7-42da-9e30-9f8b6c995d7a", "comment": "Malware payload", "value": "b499b17a217a2f9111e8f137d7202187", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894157, "uuid": "f5157126-2612-4a08-9bb7-76106d648c8f", "comment": "Malware payload", "value": "77938e7d01bf97cf19e7ab0be0f81a366ad5d2e8ccbae332f69383fb641ed1a4", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894157, "uuid": "04ae47ed-c92d-4dfb-94de-97a56a8fa3a7", "comment": "Malware payload", "value": "1fbce7c3b3906cad650199cb5f02f3020c7f5495", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894157, "uuid": "d569c539-fa28-40c7-a51e-bac79a2084eb", "comment": "Malware payload", "value": "64538a318209a5f3d88bb59db610c0abcd5102d18152c9f5f1b0c1006110f21f43fc9dbf5137ffc2fc0bba44144bbe8a", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894157, "uuid": "98657ab4-2b20-438b-ad28-51bea452a8d9", "value": "T1DA766C47F85152F4E2ADE330C5659212F7707C891B2227E72A11F3F42E72BD46AB93A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894157, "uuid": "15c787f4-2cad-4887-8e80-92aff2301793", "value": "49152:7/oCM6Y4/K8FJuirb/TPvO90d7HjmAFd4A64nsfJeDn4gwpWDXbGX19QmGnwCqmT:QcjbDPXbbz9LAMWEE2fFvOehPRfx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765894157, "uuid": "9c2e95f6-1f47-4536-ab9d-f6c8923da52a", "value": 7731824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765894157, "uuid": "7ccfa5a2-36d3-41ea-b9b6-598b8403c171", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894157, "uuid": "57373d6a-d4e7-4a4e-a7f9-2470831eb58f", "value": "77938e7d01bf97cf19e7ab0be0f81a366ad5d2e8ccbae332f69383fb641ed1a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e1f4d7-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873848, "uuid": "7c84ec9c-0083-4a57-9ec0-179d99b3ee30", "comment": "Malware payload (Mirai)", "value": "ad787e9b92d689abde6a358944e34b6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873848, "uuid": "41134799-ac67-49e3-889f-b62e57f11a75", "comment": "Malware payload (Mirai)", "value": "78186ec84f47e4cf3c3fc42f9f84964365251a27fb15584fcf2e983e79f2d8ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873848, "uuid": "8994f26f-7f11-4a0f-9185-bdf80e47278e", "comment": "Malware payload (Mirai)", "value": "f75b41b2ddf6d38bdae1ed8c034c4e68d9422a98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873848, "uuid": "866db474-1bc1-4e87-9573-ba53ff9a74ff", "comment": "Malware payload (Mirai)", "value": "26b141d1ca352708d80d98ea55d0be83fa20bf9ed72ae0b78be5fbcf728f74653a18b78f7a7627adaee8a4d9525e4b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873848, "uuid": "ff81a3af-dd64-47f3-b04c-323f76409e64", "value": "T194134AC1D603C5F2ED2512F514776B624E7AE4365A7DFA83EBA92931FC02B10960B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873848, "uuid": "b14173ac-3c54-434a-a3b0-c7679cc75e40", "value": "768:EndzSqLE+hwWEblnUY5WO9xNKSuDoQh7ts6E/rDdj6Q/p:End+qLFhwWE1UY5JfNPusUts6uDd2Q/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873848, "uuid": "1be08746-32d8-4eaa-8b03-c1b9bbb59cbe", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873848, "uuid": "5933e8fd-4853-4d45-b991-f40ae6287814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873848, "uuid": "ce614a45-8ac5-4672-91b3-50c5a0ae4ff7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df86596b-da7c-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1765889030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889030, "uuid": "015b3866-04e1-4d11-8c43-fb5617313e9b", "comment": "Malware payload (GuLoader)", "value": "1212558147a1f59bf8e5890245715de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889030, "uuid": "27f5cb59-e8d3-46a0-b494-fc7e4939f2a1", "comment": "Malware payload (GuLoader)", "value": "785518ed48eb963f55f5fc8ddb5d3cd0f65d0a5a8783604fc55e90bd25b7dc3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889030, "uuid": "1735c530-f65b-4ff3-9ef3-810e4652905e", "comment": "Malware payload (GuLoader)", "value": "0bab0e9487e41c1a19e29eb097ebd8d828fb7bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889030, "uuid": "6815fb08-704d-410c-8543-d0370eb16578", "comment": "Malware payload (GuLoader)", "value": "cfee3745d635b6461ba40bb29f048575ec102a3c21981567d2a84cbd4ce14f123947df7ba10b6ca1fe60b92c534c5b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889030, "uuid": "659e3312-968a-481d-9c7a-1e02ad6a795e", "value": "T181841212B372D423EB89E63056165F360FFADD51A8701B2B1B107A1DBE707A17E4E2C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889030, "uuid": "592d2887-ba1b-4bef-9d43-46d9a2f81548", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889030, "uuid": "b8cca5d5-baf2-45f5-bc2d-a8d46de227f5", "value": "12288:e3DmJ/wu+IDKnU94XnsG+d7kX0Hj5iWupe6q:e3CwI+nUysGW4kHNiLe6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889030, "uuid": "7b05f4ae-efec-47e6-aa15-eee865899ef9", "value": 396520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889030, "uuid": "19dff005-daad-4cd9-b571-42ab4cde1163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889030, "uuid": "db7eb71a-d571-4eae-ac0d-5111b9036ce2", "value": "Pseudobenevolently.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b3a183-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879667, "uuid": "49ce9343-04ec-4782-bf2c-12388c2939fd", "comment": "Malware payload (Rhadamanthys)", "value": "af54f32e12616c9c08efe763df2296a5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879667, "uuid": "f77254c8-676a-4505-88a2-5ba3f2c35058", "comment": "Malware payload (Rhadamanthys)", "value": "78fc0aebc3298bffc4dce4fe576de6a6d451dfe8c492caf73cf2b07515a2f09d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879667, "uuid": "03d25d3c-26e0-44a3-af13-ddccbea18ed6", "comment": "Malware payload (Rhadamanthys)", "value": "06e8a3cd08fc3fb84149d386ade880cad2eb8b20", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879667, "uuid": "99a2627a-6213-49bc-8274-95aa193e6651", "comment": "Malware payload (Rhadamanthys)", "value": "acb0c7f4a2a570761e302dc565f70d4400f04c621810bb1b18042b37123007360388b1fdf19cd5df0cc80d4f65459e88", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879667, "uuid": "55ad9c86-18cf-47ab-aac8-5797febe65d3", "value": "T125A329397113F99E3700239879B1A2F34757E1AB779A99FE1044B7B0E49E23D0E152C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879667, "uuid": "0d1846e5-a9fd-4492-a836-085e30f5fde2", "value": "1536:GDB7eKg20lrQBiTrzrWZQe1RBqzSlqHAIXggw6b6BkQWJ+aY:GDB7b0jPaXAwY6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879667, "uuid": "aecb181d-c192-4379-a196-5e1208ad1814", "value": 99491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879667, "uuid": "c60e684a-8255-414a-a4cf-855a639c4d10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879667, "uuid": "4a5a4717-741a-4159-a668-752350e9bb46", "value": "invoice-1637482117.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4f850a-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873855, "uuid": "da5b91d9-a402-4b46-b7ac-437f52333f83", "comment": "Malware payload (Mirai)", "value": "d03f70199349c8d5ece8fc550dad0087", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873855, "uuid": "54a2e378-4b68-4d79-b9d9-dd3765b7b0f8", "comment": "Malware payload (Mirai)", "value": "798d7d31c612945ff07b2e957a614d2f68c73217fd4136257258822918cc2225", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873855, "uuid": "9d2cd5fe-17da-4559-adcb-5d635e74548c", "comment": "Malware payload (Mirai)", "value": "d70a0d612b35f188d7fbfd51e77ab137e8639500", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873855, "uuid": "222b5ab3-b5af-43ba-8c64-295020101fec", "comment": "Malware payload (Mirai)", "value": "4545370d23fdfe5d8f3a2c4837db54d9d448af718906e8f95dcbc41c04b623333de73783700d958dada6747ad5c973d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873855, "uuid": "d6d0e7a2-a192-48ee-b16e-331cdd70d51b", "value": "T1601349C5E643C4F1EC1112F110775B929F75D436AA79FA8BEBA92631EC02B14DA073AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873855, "uuid": "3d627e12-9b88-4fb5-a160-8dba51ec4234", "value": "768:W835nW/NzrNopW30/94N0Yzrx63qFhBX3eiyvYeo95MFR:j5n6NiY0qmYzrgI7eBHo5OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873855, "uuid": "17b16654-9739-49a9-92b1-f5f27909ee4a", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873855, "uuid": "a5cf6ee9-729d-4661-b303-060043b34669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873855, "uuid": "624dace8-c6c1-4019-b675-1a073ef47460", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae19e06-da82-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765891251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891251, "uuid": "73f616f0-3c14-4852-ac38-fb567d5b2037", "comment": "Malware payload", "value": "59da137fce869fba5e1492b0a18a4112", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891251, "uuid": "e2665144-0820-431d-8178-d6729d137428", "comment": "Malware payload", "value": "79a9604f8aa3c63e95628d4a7da96f36a91c03691be66964b9a619b45ee630eb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891251, "uuid": "8e7583b5-d28e-492e-8faa-d5fec8e86f34", "comment": "Malware payload", "value": "55d58698aec2157367a54741d2d4bb1772249754", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891251, "uuid": "24f4e696-d19b-4883-bf70-e6a83da3c830", "comment": "Malware payload", "value": "7d811f3b55e191e726026be32bc73c29797501fa426c6124060ab71e174cf983422e3ebdad0fb2d4c0ddd649ce040df5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891251, "uuid": "35be7d38-455d-47a2-acd7-cf1da774d107", "value": "T1CC53E06DC78F85A5CF41A377131A4E4902FDB33EB30491B6746C87303BAD82E49A94B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891251, "uuid": "0cf3ba6f-3104-4fbc-96e1-c81bb533b407", "value": "768:TdMzIPM2q0KyoVCJPMTiU7O47eCKrGeSG:GsPLqaPJPMTzJKCKrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891251, "uuid": "b60f8996-cce1-46f9-9f34-8480e1b56439", "value": 65460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891251, "uuid": "afa45c07-2763-4b1c-9f53-42edd6b84d6d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891251, "uuid": "21adf410-b74a-40f7-bfa3-dc90b30a590f", "value": "79a9604f8aa3c63e95628d4a7da96f36a91c03691be66964b9a619b45ee630eb.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e27417-da6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765881277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881277, "uuid": "1074ae53-da16-416e-9b6f-7c42713696bf", "comment": "Malware payload (Mirai)", "value": "2a9b8709ce74006e5e8eb6a9ce9aee89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881277, "uuid": "5e65dba0-eb08-4fe0-bd06-7e650a36cad0", "comment": "Malware payload (Mirai)", "value": "79bd6d6b1c623d8ec2b34eb36b349fe3fdb6dc80691ef75a5799b8ca9d4e6055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881277, "uuid": "479dbd13-81b0-4fa5-b1a7-a71ab31efdf4", "comment": "Malware payload (Mirai)", "value": "942b21246b9d6741b9cb38014b67c045d26eaef7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881277, "uuid": "a42d00eb-db93-439f-aa43-7a65a00734ba", "comment": "Malware payload (Mirai)", "value": "7ccf302d9326b448309dac15ab896ad92eb25937aa16cb49eb70c9a731cf23cb651d126cd20423693b656f4e02970785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881277, "uuid": "10248847-a197-49c0-ac1f-f9d16c9c5d6e", "value": "T10093D805BF510EFBECABCD374AE9170534CC591A22A86F36B934E82CF55B14B1AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881277, "uuid": "2a03291a-1afa-4bb5-bbc8-1cbcd34a8437", "value": "1536:p7KbSiD3iusBbmQMxW3jv4+p2oOqooI0hBIZeCb6wwKh6IOuH:p7KbS+y9Bbou4K8oI0DIdUIOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881277, "uuid": "c8ceb6ba-2884-4648-9989-cc5db37c34a8", "value": 93624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881277, "uuid": "b92e4ce7-e0f8-4266-a5b8-fd0c0a414dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881277, "uuid": "a159b224-6e5d-4d79-9921-6e00616bc370", "value": "kmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbb6f3d-da61-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765877428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877428, "uuid": "3d4a2fea-b7a6-42c0-9905-2cfa1014f2e2", "comment": "Malware payload (AgentTesla)", "value": "ed63d0567735a1e13da69ae5780f8250", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877428, "uuid": "0e5828ee-57d1-484d-96ec-4e2444d3b409", "comment": "Malware payload (AgentTesla)", "value": "7a20de2722de9bc9c5808bd4bbab45d4a61f5c0ebeb126c8666cd3050345fb36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877428, "uuid": "1c08e53c-1e7e-4272-a7f6-1e731f4f2755", "comment": "Malware payload (AgentTesla)", "value": "e0fd464506942ab449cbe3d6b15ffdf3309e4089", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877428, "uuid": "8387409c-7cd0-461d-b14e-ac413fce844d", "comment": "Malware payload (AgentTesla)", "value": "b40b6452de3c50889e0de307e7c452c5402cbb212c926ad9e2a574e1e2997d2a12522c2aed96916926a44f1f3cc1c58b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877428, "uuid": "ae4bac1a-9b06-4a10-89ff-eb353a54fe7f", "value": "T142F4D016961CB847E7C416FB0BD58295F6635DA436A273E206A3FFBE0B7C103AB0519C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877428, "uuid": "ff820095-dff5-44e1-a29b-deddfc0939ec", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877428, "uuid": "14600858-9ae4-4bbd-9d7a-56fdeb47a7ba", "value": "12288:qWTYGEGwJrc2546vMz9WEqEOMAEa+PClaoJdy8//IPNsowUfCvw0yovNmUFf1xVw:qgEGwBc2hve9gTiC8odyigG+SZCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765877428, "uuid": "7d2533fb-6825-4d99-89ae-7d209755ef99", "value": 791872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765877428, "uuid": "b9456af4-daa5-459f-8618-fb970499bd53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877428, "uuid": "77919c64-f4af-431d-85b1-5d38957a9fc7", "value": "Proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e3042b-da49-11f0-a129-42010a9c0007", "comment": "Malware payload (Koadic)", "timestamp": 1765867159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867159, "uuid": "c0ff290f-6685-4836-910b-e108956257e3", "comment": "Malware payload (Koadic)", "value": "4f4b7062ead958aeb1d0088310860300", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867159, "uuid": "7dc0a50a-0442-486c-ad3f-ac328a2fc449", "comment": "Malware payload (Koadic)", "value": "7a3962542b2a4b3f2b4d157c2efbcfaba87f347419de7b2671b84be71c93234e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867159, "uuid": "39d8d879-94ca-4e80-9199-19d6631edf7b", "comment": "Malware payload (Koadic)", "value": "1d587c6cfe7991b0df8be0ea3739869051fa7de8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867159, "uuid": "1c38f581-a0b5-43b4-acea-5490ed90d913", "comment": "Malware payload (Koadic)", "value": "ee4dd01d7e6c357bc8fe3ed39a9a1b39e9e8167cf5ef868eed0a1fad02111f330abcac448f6f2c459dd99c778ba9ee43", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867159, "uuid": "0351b3bc-ca32-4bab-be0b-8ddbab417484", "value": "T11FE27CB0CDDF0BCE7178CF3EB147C0125566A87E5BE7ACCB818571681D8B28A7106E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867159, "uuid": "918f9b72-fa76-4e85-a1f6-2b3b1d711afb", "value": "96:+90pEsQZCi8mtiBKRMLULKdAD2nMhQBOgiCsxrJd7bhLLN4ZraSKkgxk6C:LmsL4IBeMWK+CMhQjb+JJx5MaSPgxkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765867159, "uuid": "93ac8ec8-3bfc-4b9f-a719-d86609c03db5", "value": 33261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765867159, "uuid": "32fee152-19a1-4053-a50f-9cb2aa2410aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867159, "uuid": "8af0c6e8-aafb-4fe1-aade-9289183e2dfd", "value": "7a3962542b2a4b3f2b4d157c2efbcfaba87f347419de7b2671b84be71c93234e.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8f07cd-dada-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765929081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765929081, "uuid": "753e2c28-b17a-434c-996e-bac7839b40d6", "comment": "Malware payload (Mirai)", "value": "457741af438ed3c39dcb615b8a7f0395", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765929081, "uuid": "ab6337c4-d360-4fe3-8c13-3ebdf5bde5ce", "comment": "Malware payload (Mirai)", "value": "7c221092d32dfe4aa0585f6aebd00ab6d10eb51e924c33533021e5092082d90a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765929081, "uuid": "c53d9f25-b18d-4969-a102-0f0319a12e2d", "comment": "Malware payload (Mirai)", "value": "37f3f870dc0c1b61c22f35dc658d5de1d3a8f567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765929081, "uuid": "12b49b58-312e-4c21-b31e-fcfe1b29d213", "comment": "Malware payload (Mirai)", "value": "73b5fbdc354f4463aedf44c53681c3e709932f0485faf03bcc14cb1c864b3eb52cea475b0361aa04ae02adcf13b3f7dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765929081, "uuid": "9ed72fe6-d594-4fa5-b69e-c8ab7c081d93", "value": "T1D5A33C83B00DCD7DF40FD23685EB4A1E6624F6994F410E23E152BC9BA9670857E2DDC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765929081, "uuid": "275345c7-c371-41a9-b252-918b76f98dcc", "value": "1536:ISlEq66oFCObIERJ87zHthEH9RhO2A2oiPED8QKg4Zf687jY2pGNkxfT8M7TPtYu:IQEKJ3zHt6HHhe2osIy702pGNefYMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765929081, "uuid": "8d929acc-74c3-4f8e-9677-985d6f75979b", "value": 99080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765929081, "uuid": "328c0b53-8805-4f6f-b37d-2673f74d9402", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765929081, "uuid": "aec0f8b1-594a-45c9-9145-51bf9c6d046d", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba11ade-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873857, "uuid": "3fbc407d-fe3d-40a7-8e64-c4fc334abf38", "comment": "Malware payload (Mirai)", "value": "729afdf3a2b63ee2ee2bed1a287886f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873857, "uuid": "a3656db1-f3ea-49d6-bed4-65e1140ca4ba", "comment": "Malware payload (Mirai)", "value": "7c3ab4631845bdf6d1f1a8875caff94049d9a96946e38122a8bd330a706d4af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873857, "uuid": "770019a2-6757-4284-ad19-fa18e13f6d20", "comment": "Malware payload (Mirai)", "value": "60ac7441f896e669d9200b846c2793859404ab58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873857, "uuid": "5fc3a6c9-8a94-4bfe-9402-4d6cffbaecd5", "comment": "Malware payload (Mirai)", "value": "9a3f9bfcc94d648c9f8ca260ad6246254c57528bed56691b909df35454db87f513d022800ea1edd742bf05601e150a96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873857, "uuid": "46bbdb22-f112-4805-9d47-a4abb0475366", "value": "T1EB53931A2A658FADF76C873487B74E229799339723E1C644D15CED001F7038EA45FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873857, "uuid": "25f8e257-3b34-4530-96f7-20201aa66d62", "value": "1536:tMBsSHh+K/deplImHhNM1SaBcm9jmkHZE9:qHN/devZhNEjmk5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873857, "uuid": "b27e92e3-27d2-455e-aee1-37b8c3ff9efd", "value": 63660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873857, "uuid": "c36be3d5-ecae-4b64-8630-3d826462ee54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873857, "uuid": "0b57b06a-0c60-4f94-83e8-55ed633caec5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a54ab85-da54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765871627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871627, "uuid": "2dc2afce-f774-4c61-9ebc-01432b8bf152", "comment": "Malware payload (Mirai)", "value": "f76074c598922e65c44ef75c7b5a65b5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871627, "uuid": "e9afdafe-9d15-452c-8fe8-710a59e9be94", "comment": "Malware payload (Mirai)", "value": "7c54df1f3e34ae697a519f2654f25ae7727afc19c3f6d4bd7ad36918496ecf27", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871627, "uuid": "2d477814-a71f-4327-bc05-2b295f40a0aa", "comment": "Malware payload (Mirai)", "value": "11907bac109a1226e37bf0d78d93616a5fa3e060", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871627, "uuid": "d2246dd3-5ccf-4431-a1e5-4e47527804b9", "comment": "Malware payload (Mirai)", "value": "8ea42cff67d760b3a9513c3c2f194ecc94e4e2fde075dee346a02b2817464ee131d6a5e6ee025ee54bd8c528e27fef67", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871627, "uuid": "630a4980-1aa5-4077-97d5-3d434c6d1dce", "value": "T11C01D89842806757D34C8F2FB79350BF2721E6CD641A2BC0F38766B897847C5B028A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871627, "uuid": "009d8a34-e11f-4642-87bb-96607f9d9a38", "value": "12:KhI5W3CtI1/TbNM8BpFzBwBtM8B81npLOhcM8BO26M8BeliAE/M8BXqlHWM8BFot:KOQyS1bbekBTR1npLO9Zw1liAjIqlV2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765871627, "uuid": "ca1ca179-8135-40be-92fb-c0d633123168", "value": 705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765871627, "uuid": "e8a66262-1adb-47af-b3bf-244453678b31", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871627, "uuid": "86244850-f15b-4990-881b-cf4b964925b2", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cf87b2-da4a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765867249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867249, "uuid": "3c6254fe-64e6-4f83-b4ea-5dc54d44e8af", "comment": "Malware payload", "value": "aec056a723f54c21d8dfaf3f3cc600d6", "object_relation": "md5", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867249, "uuid": "133f5fb4-4736-4764-9c13-b545bdbf92b9", "comment": "Malware payload", "value": "7c730c4e4b9782a6b62e063a71b6f7235ef844aab7a450c7a55923a748a26c65", "object_relation": "sha256", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867249, "uuid": "230df218-b149-4736-9bfb-dae1015366be", "comment": "Malware payload", "value": "8a6ddf8db84f043396d59b643d610ad285bf403d", "object_relation": "sha1", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867249, "uuid": "96ddbf3b-6b43-4da6-b2cc-308f4cc8fb46", "comment": "Malware payload", "value": "9322069860119385209e266bee4641483e1b26950cbf18a4542433bb4ef66374d18e361c3bbd02011215a3afb491dbc6", "object_relation": "sha3-384", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867249, "uuid": "f67b1b30-7361-47f0-a34e-63b6f96a776f", "value": "T1E7073366851DF8D3CC72E37829F6CF0A662FD6951B31AB4E1F3AE5886DA90D0430670D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867249, "uuid": "61707fe7-ef87-48f4-8d99-7b6ce5bf52ba", "value": "393216:JXRcBVFq2sqklve8n2Df8kY3ucN6Os2Ly+ugmgnhKTudNPP+:7c9q5lGfDf8Nuc82BugmghSuPPP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765867249, "uuid": "bdfc5332-4f18-4e2d-9607-0e8fcf3be98f", "value": 17379436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765867249, "uuid": "ef7aefdc-c77e-44b0-b2f9-dd7e753fbd92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867249, "uuid": "aab0d600-ee30-4faf-83c6-6d15de364ebd", "value": "PhDec15ST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217be3a0-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765895584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895584, "uuid": "c7d394c3-ee4f-402c-986c-deeb1d91bb17", "comment": "Malware payload (Mirai)", "value": "9a2355e4f83b6d04c4a5983d6d4a9e68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895584, "uuid": "815f1190-7c89-42ca-ac71-8aa531c3a389", "comment": "Malware payload (Mirai)", "value": "7c9e9e5fe51e53eb97b09ab9feac8176474c56855978268466e28f9f11422b91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895584, "uuid": "64f5409e-d8a4-4eb5-b743-e507578f1097", "comment": "Malware payload (Mirai)", "value": "fc3b25cb116e03f6198aa5fed78ffcc54405af7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895584, "uuid": "5ab108b1-675f-4a73-a582-672521d938b8", "comment": "Malware payload (Mirai)", "value": "7155c296075bdc9482b0e1ed3f21fc10c0f5fe4bb498a95d0de8291f311316f47627849c8e892ef1f6643c5f9d03c33d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895584, "uuid": "a8a6d029-8ced-461b-8b92-1915ece513bb", "value": "T160B3F715BC429B12C6D7677BFFAE02DC33162394D3DE7507A8246B65B39B02A0F3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895584, "uuid": "4636fb2d-43c6-4897-a5c6-1ff8f39f168e", "value": "1536:EgFGiKSdFyquax4q36vaE7HjyYWzzcGR/KOfzwY4/gOluekoMl8nTo50uu:EgoVWMrjyYmrFfzwY4Is/kNl8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895584, "uuid": "d368c67f-5b75-4ce5-8e32-c4c46a09cb7c", "value": 117452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895584, "uuid": "4db83ba8-3bc4-49d1-b024-a2099ceb647b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895584, "uuid": "e09822de-8ca2-4a75-a221-6a5d17e55f27", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c26a07-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879963, "uuid": "209ebef2-37ec-4869-9da6-9f83715beb9a", "comment": "Malware payload (Rhadamanthys)", "value": "fd747480b80448265841e4b1eac92e09", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879963, "uuid": "8dc1a676-8d13-43a3-af09-fb7157275ec4", "comment": "Malware payload (Rhadamanthys)", "value": "7cb714aad641c682c9e7f03eebadc1f0a8bc261bd2a00dd7b4c874d00ad1bbeb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879963, "uuid": "49cd508a-93cf-46f6-b73f-a13b733e9fc3", "comment": "Malware payload (Rhadamanthys)", "value": "0ff9f18976a8f98ac799a2d0383b310976c8fd0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879963, "uuid": "9a0bd553-aa69-40f5-97f6-7a8ef4a79d74", "comment": "Malware payload (Rhadamanthys)", "value": "e66d0f9bb328d8763afe2fe900ce3a7b7866fea3ee412271a8043df1dfa985bcba30c6fe3f2de9fe7902ba5945fd1d03", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879963, "uuid": "85a706b4-dc6a-4744-bbbb-1f192a0741b6", "value": "T1D593F80F8B9334924EF078931F951A7A943A80BF4B6919ADF19FF713609A9091CCC9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879963, "uuid": "451d1733-3c94-4389-9776-e6ae544933aa", "value": "1536:GDB7eKg20L0prtrYCGJCCkzqRAubcLky6BkQWJ+aY:GDB7b0L0JRFGgCkzqxbcLky6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879963, "uuid": "47bc3afc-56e5-4608-b89e-a59874e533db", "value": 97399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879963, "uuid": "8b938b79-83db-4482-941d-9202ed0884e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879963, "uuid": "046f967f-94b5-41e6-b7a4-6abda5672228", "value": "invoice-1637482117.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7ed448-dab1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765911764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911764, "uuid": "97b895d2-e891-4f6b-8707-d6df1ffb1f53", "comment": "Malware payload (Mirai)", "value": "bd95d0f46c2b3748500ada003e8e448f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911764, "uuid": "d4a89509-128a-4cfd-bc91-95bbca56a743", "comment": "Malware payload (Mirai)", "value": "7d07ed8c4c8bb66f22ce2f0e896343bb6e2ad8edd2ddc76d499bc19901d889d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911764, "uuid": "0d0cc081-f9f3-485a-a397-9dd1387e7a17", "comment": "Malware payload (Mirai)", "value": "a311ca8b97738e190e0544caf936b31e91696fe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911764, "uuid": "9f093bf8-20dd-432e-9ab4-05210e98a25d", "comment": "Malware payload (Mirai)", "value": "d0ea5b804ee77137e8e15b57e360cafdfb8b294a78b900a3dffa9c364352e57243bf6ac88e2cd9b40446fc61abd25048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911764, "uuid": "a5a4e661-6580-430e-8bbb-efc5ec44a458", "value": "T115C32A86B32C8347E0428FF56E3E37E4CFAD696060A4B78D241BA60E1176D764446FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911764, "uuid": "40222723-5428-458a-8d34-b16c591f6de9", "value": "1536:KEL0GQIzkfP75cBIgCfpd3XYSOmsT5QCPJivi78nXhVR15Yy9gG:c575cnCfp1js2Cv8nXz5Yy9gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765911764, "uuid": "96553fd4-1b60-45f3-8946-b3fcdaaa997a", "value": 121044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765911764, "uuid": "06425e9f-ece1-40f2-bcde-9d354ae240ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911764, "uuid": "081a8c24-f15d-44d0-b2d2-a90357f93ac8", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233a3c55-da70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883561, "uuid": "fd78ca85-70d5-4112-9654-b9674402e6ac", "comment": "Malware payload (Mirai)", "value": "9c7b3cda457ee51e04c47202e5f5bf0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883561, "uuid": "43b610de-c033-4d5d-b88c-c8f35ba5d192", "comment": "Malware payload (Mirai)", "value": "7e4a59af23cf6e2570b608352cc517278a7c8109557a168dc961983a04ebfff3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883561, "uuid": "fd79b5fe-aa77-4821-8541-366dd1f4064d", "comment": "Malware payload (Mirai)", "value": "3591bad23893caf87fa648744aed88ec183b2f95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883561, "uuid": "351a92cd-fd01-4e26-9c3a-0471e57fbf42", "comment": "Malware payload (Mirai)", "value": "b8569668382145d6e4c6634ad4510d2e9589b57338641b9ba5280fa167cfec658861b356f6bb1a5dd2fc3697a1d72b0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883561, "uuid": "7eb60bf0-9d4d-436f-aea2-ad293b5bf065", "value": "T1BFE3C70A2F601FFBD85BCD3749E94B09588D561332B83B753A70EA04F61A15E0AE3976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883561, "uuid": "d335c305-4c46-4455-9e5a-f7c475c2cb41", "value": "1536:jY/08nFRMkk2i36QSfGzFX3hQJgPfWKpVsLpesC7oOIttGmiY3bUiFyMPYWMK58e:jY5skTiufuX3NP6ymiajYC8n165qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883561, "uuid": "78df0073-1b5f-4647-bb2e-e9de78b60923", "value": 155524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883561, "uuid": "66a054ec-fcd8-401a-9b2e-71a4ca9a65f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883561, "uuid": "49ee0b20-eb63-4677-8daf-2c78545fe931", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5610ab16-da92-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765898249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898249, "uuid": "554d7102-b77c-4000-9d31-75f95f417ad2", "comment": "Malware payload (AgentTesla)", "value": "a382675fb10995a93f5d05c3e235d606", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898249, "uuid": "d04f26bb-b5ab-48e0-9b4e-18d68ccd8495", "comment": "Malware payload (AgentTesla)", "value": "7e7b9fbc3e8ea0f47980169333e3e2d05b53a803238d02565a0005d8d85647cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898249, "uuid": "4a3da7c1-e6a1-4dae-9876-2261d1844b81", "comment": "Malware payload (AgentTesla)", "value": "3c2675098e7e5b03fa6c3de386e8547a3d12b980", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898249, "uuid": "e7886aaf-e076-475b-81fc-00b26aef9d69", "comment": "Malware payload (AgentTesla)", "value": "0d5c54ba0c185bdaf4ae34ef1c62385dfb1fc4f2d8bfc883cd2fc9b47b6f3c6656de45f57e1d2475ec9cd3b90a8ca08d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898249, "uuid": "5c10dc85-9d89-4d00-b888-e405abefbf02", "value": "T1D945F1218D846FB4CFA8991890FE161EE3E0468F445A7589FF3BBD46AFF7A44050B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898249, "uuid": "e44882df-f714-464f-8fbc-4c6caefbc7cb", "value": "24576:awXgu1ai+geJZO2iaF345Zy1Nnl0mZQ+DQVB:aqPy8oAKNl0UKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765898249, "uuid": "ac5b01f3-a67f-47b0-9e74-7bce07bd97e5", "value": 1248283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765898249, "uuid": "e87446ad-0ff2-4b5f-8bca-bfd6fe179c61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898249, "uuid": "0bb8fe58-b4d2-4f79-8ca0-c8a279c97b33", "value": "7e7b9fbc3e8ea0f47980169333e3e2d05b53a803238d02565a0005d8d85647cd.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852811f3-da1c-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765847647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847647, "uuid": "30b49dc7-772f-4e8a-9c4b-b33c2c4ee628", "comment": "Malware payload (QuasarRAT)", "value": "2fd9f2a6516a9fb95afb87b424a02e6f", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847647, "uuid": "20ccaf37-1645-493f-9ddf-223f55b477a1", "comment": "Malware payload (QuasarRAT)", "value": "7f02d6e0dae9d69f2645f085817d47ee8168f1c5842122ddfbd5af5f12c7d498", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847647, "uuid": "ee22116e-0329-4be7-8abf-af556a073bd6", "comment": "Malware payload (QuasarRAT)", "value": "0e4ff2d37ad7c6e08c7aba22b0e844653a1d4b91", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847647, "uuid": "92f805a2-8d18-47db-8071-8fc07b001c5d", "comment": "Malware payload (QuasarRAT)", "value": "9134b0a29aed5a39c9d18bf3de717cd2a671b6603f28632c3bb1a72733aa3e1685b467ebf311f5871c597e3a1af66252", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847647, "uuid": "06f71070-7a32-4462-8b5f-d9c18f1dbf23", "value": "T1D8F52B143BFC5E22E16EE27395B0042267F0EC1AF3A3EB0B56917A7D1C63B5489416B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847647, "uuid": "adde4d26-51df-4f24-92e2-91a2643a50d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847647, "uuid": "6c053b79-4034-4ee2-9a52-0e67f398463c", "value": "49152:nvIcfX2hcawDEhPLl8r/ptXpga5843HgwjhdToGd5THHB72eh2NT:nvBv2hcawDEhPLl8r/XXpga5843Hgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765847647, "uuid": "c0191066-b629-43ae-b9f0-f48075abc3e7", "value": 3334144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765847647, "uuid": "436ec849-2ff3-43f6-aac3-d98febf60c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847647, "uuid": "ba2761ef-dead-4306-94c4-c7dc058ef4d6", "value": "Client_built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563485eb-da2b-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765854011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765854011, "uuid": "f4ce3da7-6875-4b28-8f55-69b6345dcd95", "comment": "Malware payload (Formbook)", "value": "4ec75eab12406ed07352e5fdf31cd645", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765854011, "uuid": "0107b4af-837b-419f-9e20-daaac14db8de", "comment": "Malware payload (Formbook)", "value": "7f039d28d7d9f230d66bfe6739e811a23635387fcbffe7f00e843bbee63b6b24", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765854011, "uuid": "2a704a00-f2c8-4cfa-8c37-5704b750805b", "comment": "Malware payload (Formbook)", "value": "c710a7a1ea7597a45298f09f88ee86689c4c3500", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765854011, "uuid": "8b3e1585-602a-4f9d-84ad-f5097280a3dd", "comment": "Malware payload (Formbook)", "value": "1d4eeba97f09574b826402873d3b2714f517d01955249c10ad9c39ecb31f5aede8b61ff40c2f82b95aa824ab40b1b022", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765854011, "uuid": "12c7c194-0923-433e-ac14-b9888f67ae1f", "value": "T18DA5C35D84B1ACD2A054FEB4F685FFD78CDB4385162B07521FE4858A3312C83FAA72A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765854011, "uuid": "87ff0f35-8029-460e-bd6b-2a7ad7ebb225", "value": "12288:lfD99PGs/esb+UzlVZdDm5WTjcSHpFhdw1VX90MUGK4SnGCZ6hH0BwqwSSSdddS+:pu/STjpbbiv27wqwUVSTMP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765854011, "uuid": "654f630e-8287-4e45-8763-2e28017aa795", "value": 2112464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765854011, "uuid": "f99a0207-f39e-4398-a2d6-7126ee89153f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765854011, "uuid": "3104d3d5-1e36-4a8d-b112-bdeb81fd7ba3", "value": "rSampleSpecifications.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1284189-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765880014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880014, "uuid": "678bc8bd-3a4b-44f0-95e6-b0a59548ef79", "comment": "Malware payload (Rhadamanthys)", "value": "75e340fd0f461b231f78bcb39624abdb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880014, "uuid": "93e8a188-6fe3-439d-86d1-1d84b59bc881", "comment": "Malware payload (Rhadamanthys)", "value": "80118e34dce15db319ef461aed573469d2af8cda2313f1daa322208343e302b7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880014, "uuid": "a223ceef-71f1-45d9-b457-1f0adc65c595", "comment": "Malware payload (Rhadamanthys)", "value": "8c34888e5f63bfbe512dabeb2eb42113ce5ec843", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880014, "uuid": "b1069eea-dad7-4d73-89f2-3e77183c089c", "comment": "Malware payload (Rhadamanthys)", "value": "fb7438886150175d6492e573eb10f56b22a5b39c401bdcec48e0dad23f3b0aa483d48ba9ce228849fd342509f5b7e1bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880014, "uuid": "0724a9ec-cdc4-4e0a-9e81-8217232cbae2", "value": "T17AA3091E6A2B9FF18249B520055FECF7AB093B1931B6104DD5A97F3084CC392BA925DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880014, "uuid": "1699b0ea-597e-430a-bba4-098f823fa338", "value": "3072:GDB7b0ULlqBwOcRKtJYHmHYbUHHwdxY7hwifviOmVJnGCT4rnYT1zWC8FmVOaC0K:0pLlqBwOcRKtJYHmHYbUHHwdxY7hwifV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880014, "uuid": "6c8771c6-297c-45be-a765-1043e08c997d", "value": 100098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880014, "uuid": "9a27dd66-3541-48d8-8985-c17704d54f4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880014, "uuid": "1eaadc3e-be09-49e2-a5aa-62d60d696d5e", "value": "invoice-1637482117.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b88366a-dad4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765926497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926497, "uuid": "c3122327-ab6a-4f76-8fb7-57903bd30808", "comment": "Malware payload", "value": "7ef7155c0db1872ec09cf75c2468028e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926497, "uuid": "10f7e119-0600-4389-b0ae-1402abc2603b", "comment": "Malware payload", "value": "807461046dd5a3677e9568f984bde2c49bba6f33293ae9f087fda430db4e65b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926497, "uuid": "26e4c5a1-dea7-45d0-8fdb-fc1783bd2b22", "comment": "Malware payload", "value": "62f4c5acb5bbd46bfe1ac933dc6841022a7dba87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926497, "uuid": "1fd11a60-be0f-48f9-b3af-e5dbf070509c", "comment": "Malware payload", "value": "15fe5a33fc69c4aee104b2c7743bc23ff0ae1ac2993b7729ca6a92cde94a979ee68d943a894653de93719fed0d0a9407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926497, "uuid": "d5cfa780-a4cc-4f44-88a7-0c256b81d1fe", "value": "T122933BD1EEC2E4B9EC2B0171407657B78A34F97B10ACDA4BEB7843309C51222B6577AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926497, "uuid": "26088007-6abd-4b77-9ad9-c20fd8fd48f5", "value": "1536:6/njtH9lnUU2iLVznnE0BTFbvK8mcdjVEd1p3zk5ghoESsZHoDNfHf:6/nZHrUHgFNBTlKEjmTp3Pu/MHoDNfHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926497, "uuid": "49700045-8a5a-4a19-9b8f-7f1ce490d1b2", "value": 90768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926497, "uuid": "c7406546-5708-4579-aca0-2a6c64440c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926497, "uuid": "5ed92148-4362-4546-8089-179f0795b5c1", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f6b657-da7b-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1765888632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888632, "uuid": "dd8089b8-6f2e-40cc-b9f0-45d9e48273ea", "comment": "Malware payload (ValleyRAT)", "value": "edef5b012b05ff088ded586917555813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888632, "uuid": "cc248bb9-9ea9-423a-875b-cd6eef21f798", "comment": "Malware payload (ValleyRAT)", "value": "810e5bad70bd2a59c7c0462716d4a63beee9e680e65cf6e5998a81f26467aa1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888632, "uuid": "70953d7d-f0f0-4ef1-907b-69592104eb33", "comment": "Malware payload (ValleyRAT)", "value": "cceb599b24dd764c2d7d8effd20dd80dbe8d8e84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888632, "uuid": "5e4291a7-7350-432f-acc6-187bfeda01d3", "comment": "Malware payload (ValleyRAT)", "value": "0087f3685c6660d6870c3fae568452fce66fad0db8b68385583e63da50f7ee25430629bc5bf40f508cde66f9045d58ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888632, "uuid": "9ed91bc3-b50c-4ad4-b9df-92b7d41d4c60", "value": "T1A373E173C9601C94FAF59A30828AC93E6AB8F557E674C3B3030186160F70F64BFA575A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888632, "uuid": "801d225d-b6c2-4087-9f60-1ae66dd74625", "value": "1536:NBeqek3yCfNlNw02rehekuImUN/uPSXcLjOe+o7ZSCfZ610a7Elxe:NBeqekXfLNfA+ekuILN/uaMLjO8fC0ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888632, "uuid": "795dda9b-6dd8-4d95-90a5-f88ad25c122b", "value": 79392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888632, "uuid": "1f4d2ca1-f971-4f1d-9a5b-f320976f3107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888632, "uuid": "67396942-2bcc-4875-aec1-48811f075a76", "value": "2025\u5e74\u7b2c\u4e09\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f\uff0c\u8bf7\u5927\u5bb6\u4f7f\u7528\u5185\u7f51\u7535\u8111\u67e5\u770b\uff08\u6587\u4ef6\u5207\u52ff\u5916\u53d1\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26605cab-da70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883566, "uuid": "ef26a165-ceeb-4b2d-95b9-90e5de8d4ddb", "comment": "Malware payload (Mirai)", "value": "9b9cd8d151ff538289b6d70ca0445420", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883566, "uuid": "92e9476a-b11e-44dc-b8e6-a3e343cdb9b2", "comment": "Malware payload (Mirai)", "value": "810e6fa04ed618906c50bc9c3fe80355ba06c8633683b101971c1eb6b0aa1813", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883566, "uuid": "4f697c23-e768-4aed-a2c1-d28d746b9767", "comment": "Malware payload (Mirai)", "value": "39029c4a93812ac668e7f3eff76017d7e0f39c94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883566, "uuid": "5d973e41-7288-4dd8-a9b8-8c8ee6f5cee3", "comment": "Malware payload (Mirai)", "value": "c042016652a918feeb9a3a2a0dd36a58e234659571a815bf4ef8514eb860c7589a98dbc1db556e5f8fb292c0ec19138e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883566, "uuid": "e88133f7-3f42-4f74-8863-74d8186b36d7", "value": "T169C30851DECBD4B9E845053030766333DA38FA35011BEB8BDB7999B29C812119A6DBEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883566, "uuid": "d3d65dab-5059-4ba3-a536-966dd854216c", "value": "3072:3OTtGSYfJO2W1f2V/CERyeSmW+IP4CmmqQGKT4FFaBoDU:CMSh22et/yeSmFWgjK0qBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883566, "uuid": "d18f3bd3-9264-48e1-8a11-cf7982d75fc9", "value": 119760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883566, "uuid": "1726b25c-230e-4ac6-bedf-1d7b8ad4e80c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883566, "uuid": "75d9e499-fd1d-4e26-8631-6798317767d3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517a5218-da15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765844554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765844554, "uuid": "881e3f37-1254-497e-89b2-66fdc9159590", "comment": "Malware payload (Mirai)", "value": "69908615b31d870525b5ef03081b9021", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765844554, "uuid": "dec2a8fe-ea14-4386-9518-6307869956d8", "comment": "Malware payload (Mirai)", "value": "8124933f282cb1de682397b68f0f5ae17e397039639ac1446616d9b0c5ebfa96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765844554, "uuid": "d4d721b3-a922-40d1-aa8d-fb9f5b17ab47", "comment": "Malware payload (Mirai)", "value": "6b119a479135d5b0319e22a9d1f9a73005b81dc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765844554, "uuid": "0e9f75dc-fc30-46de-bfc7-e0ff40b7b395", "comment": "Malware payload (Mirai)", "value": "77c15df6cd88286539b32e998b3351ac9fc1eea29d59710ea81361a24744582ad522b953c5d3ff055ea6557198afedc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765844554, "uuid": "1bbd167d-0a4a-4bf1-9c19-05c10c5baafa", "value": "T193D3F9086B518F7BE4ABCC3741A84B4928CD914771BC3BB53DB4E504F65A18F4AE38B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765844554, "uuid": "d2955ab8-0e97-4c3f-8773-0afcb035862b", "value": "1536:yP+r0TrnT9vtI8BmswMUv7X5439wcwr2rCUi6BJ7lVbczLbV8nRbVR15lAAVx/:yPhBG8BmsMv7R2rCDq4zF8nR95lAAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765844554, "uuid": "d4fff9e9-0add-4d05-8bd5-08cd2dabacbe", "value": 135136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765844554, "uuid": "f301f99e-b15e-44b9-9af0-3c666e6c11e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765844554, "uuid": "bf680360-d9b0-4b58-9610-789fbbf0ac98", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fe6c91-dac5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765920148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920148, "uuid": "4e14a193-9885-4f7e-8006-245e3f687901", "comment": "Malware payload", "value": "2f951daefd06b5db4dbbdc22873bc612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery.D", "colour": "#5B9F15", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Fuery.D!cl", "colour": "#02D62F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920148, "uuid": "d81ab353-ea45-4036-b523-01690972b50d", "comment": "Malware payload", "value": "8153f50071a8a26c10eb58d9585c94c56c7d1fab5e8a9677939a409544776d9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery.D", "colour": "#5B9F15", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Fuery.D!cl", "colour": "#02D62F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920148, "uuid": "5c3c0a8b-ec5f-4612-8de3-6b461e0d6052", "comment": "Malware payload", "value": "ecb36bc6174364822eb1623290142280d0a8e6e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery.D", "colour": "#5B9F15", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Fuery.D!cl", "colour": "#02D62F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920148, "uuid": "18380b27-e5ee-480b-93ec-61665530e74d", "comment": "Malware payload", "value": "2b7748ed9aecc121d312ffba234d7b98ca66bd481ba4d2a66337c678148b1c0fd9c2283daf798866bdd1f071e7833c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery.D", "colour": "#5B9F15", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Fuery.D!cl", "colour": "#02D62F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920148, "uuid": "c1f7c5ab-0ff4-40ca-90be-6421d66d4583", "value": "T1BAF32A0AABE415F3CCB4A97D51119739F6203EA11F2C46DB5B41363A6A33AD29C39F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920148, "uuid": "a3d0f3fe-d0ac-4a59-b099-ddb5197e4ef0", "value": "3072:aBeqekHyMfdqDAZQXcISp8VxQ3336OAWOALOAjG03W19cD0UTurvPCFMZVgzXMMo:5MFqDAZWDSeVxbOAWOALOAJil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765920148, "uuid": "34276417-d8b7-4d14-8de9-03cb01337263", "value": 167456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765920148, "uuid": "391ce3d2-c2ed-48ee-95c1-42311660d7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920148, "uuid": "f9917e5a-8cfa-4c3e-9088-917a9b18bf32", "value": "w065000b202512114text0ckrp50svhdjmt3rl00453h0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55b6b27-da48-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765866706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866706, "uuid": "cb0672a7-6bef-4917-ada6-75ec7ed8d86a", "comment": "Malware payload", "value": "993fdb151dd28ee90d55073b6ff68f77", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866706, "uuid": "ee4d131c-7fdd-4c07-930e-de8df7c426ac", "comment": "Malware payload", "value": "81fd03ce681dccde0d8046d053486516fe9b945c942d9eeec63201f370678cdc", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866706, "uuid": "1ebd9def-2dad-4219-8f6c-bc3c98faf9cb", "comment": "Malware payload", "value": "33cf4d5798d589effe0ba8071e1cf4fcf1ca4ce2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866706, "uuid": "8d4f63c5-fba5-4201-a3c3-3d03c100d094", "comment": "Malware payload", "value": "10795ff82d13b2e99aecacc2097bdbf560ba2f4b4e7780d7954f1244354f4ab3321be9afcca1aca8126a8f65083c86c0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866706, "uuid": "29d89f86-bb2e-4346-b55f-bcb85be7229d", "value": "T1B214848F29DB86CE4B5F346A401F5E02E65E152309ADC5803D5FBE857F25EB4B0A2BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866706, "uuid": "5aa297b8-44ef-4f3b-bcab-a1107acbc4ce", "value": "6144:Wtb99q9gvrWzFsCSERPWQ8sUoydIqRv/nzuB7YmLB4wMHtKSFo2i2c4:Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765866706, "uuid": "77bea418-1f0a-4d8e-8c16-bb1da5a339ac", "value": 205263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765866706, "uuid": "66845de6-8dfd-4dc8-803b-3a7de284eb6a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866706, "uuid": "2843edda-d0b1-4b85-9700-541f6fcde5ea", "value": "Production_Gamma_Build_302.csv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15900e5-da12-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765843507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843507, "uuid": "de3c99d2-8fb1-4a7a-ae3c-7fb20ceb8cc7", "comment": "Malware payload", "value": "9e1ae0ca95dd21f420b4e9e7be70e27e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "locale-respondent-realtor-excellent-trycloudflare-com", "colour": "#41D6AC", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843507, "uuid": "1109aab5-be06-4163-be08-e6baeabdfbed", "comment": "Malware payload", "value": "832326f3a377973a35cb465bd3510f5f6199c7454a0e0557e4f95b85313a76a5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "locale-respondent-realtor-excellent-trycloudflare-com", "colour": "#41D6AC", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843507, "uuid": "43f6bca6-16e5-45b2-91d1-903443fc2e51", "comment": "Malware payload", "value": "5d93b5f6a059b75086cb1c169e6e98834e9dd7c2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "locale-respondent-realtor-excellent-trycloudflare-com", "colour": "#41D6AC", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843507, "uuid": "572aa3bf-2bde-416b-8ec7-0912456962ae", "comment": "Malware payload", "value": "c8d64d9c1d1dab8823b4ceb6fd6bd548f5a4643f81992ea51add896d279abf5c8d524c06953949cdf8f9e69755ae657c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "locale-respondent-realtor-excellent-trycloudflare-com", "colour": "#41D6AC", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843507, "uuid": "82dc79f9-9201-408c-b783-e48d195ef1e9", "value": "T12441E441005EA03040BFCB3E5A55A19FF94F50AA8116B65EFC7CD15B6F311ABC2E9CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843507, "uuid": "b801f6e5-9e98-48a4-9ba4-93754337ca8b", "value": "48:qVD4dNZzX62tavTZh1gzUWI2UFYgsqGhAtavTZh1gzUWI2UFYg6:qSNk2ta7MUdUn2ta7MUdU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765843507, "uuid": "6351c33f-511e-470e-b1e1-43e7587e0d84", "value": 1905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765843507, "uuid": "b4856960-d14f-4b00-8e60-17f0c8db34fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843507, "uuid": "3081f317-4bc9-4335-8d87-387615ea151b", "value": "PhDec15SU.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95cb54a-daa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765907972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907972, "uuid": "fdc3757e-33f9-47a0-b8a5-37543f7b318c", "comment": "Malware payload (Gafgyt)", "value": "61dc913dd606f024e209691cab6d2778", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907972, "uuid": "52f5a27d-460e-46e1-9919-08dd39769683", "comment": "Malware payload (Gafgyt)", "value": "83c82305868e05db274e6c5a937233bf42de50803ce0f8abddc0ed650b4520f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907972, "uuid": "e5484226-f7af-4168-92a3-14cbf115f375", "comment": "Malware payload (Gafgyt)", "value": "8acfccdfa54c471929b5455c0493e70e76c154b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907972, "uuid": "6688e74a-37cb-49c9-9121-427d70adf14d", "comment": "Malware payload (Gafgyt)", "value": "f42040e9c2daa7001513a39eabbc75130cdd7cb4bf424bf6e313862564ee137c8d626cff41119f98cbd7b94f0307a56a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907972, "uuid": "29df2009-4aab-4ef4-ba5b-22ce9081e5a8", "value": "T184838D66A0099FBBD18C4D3660E19878C72318D31A5B2E7F95B187B300C7966FD2A367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907972, "uuid": "0c9b5524-1564-4218-a90b-850b89fe7a80", "value": "1536:tNSJ3VLvh/NkExeuxxcbTIFVok7kdRUym/UCCr/CUV:tEV7HdxeuxxcbTIF6k7kAymsC8CUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765907972, "uuid": "190762f7-522b-4d91-9c86-afedc0fd1dde", "value": 82808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765907972, "uuid": "f696673f-a172-4f98-99cb-2071a7397b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907972, "uuid": "3b0f0ca9-4440-4823-8c2f-579f858e9acc", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f93a4c-da72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765884607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884607, "uuid": "8fb1cdbc-ba42-4c83-a95b-9dbf381671dc", "comment": "Malware payload (Mirai)", "value": "c7b6a7e1be81491e3fc441e0f3fa0b7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884607, "uuid": "bd4d2d1c-4bf2-49cb-9c9b-a020f2db77b0", "comment": "Malware payload (Mirai)", "value": "8415b1cdfccc6ac18d99c34297a7c255ddbaa529b41ba017f23d8f105013f0d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884607, "uuid": "4695846a-47a0-4ada-baeb-fc545dfed843", "comment": "Malware payload (Mirai)", "value": "0386cd798d26b76f43b4a94a6ed2020e1ec7150b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884607, "uuid": "b79a1d6b-9830-43c9-ab92-dffb04954862", "comment": "Malware payload (Mirai)", "value": "0a47c33c80ec44dc7962809bfcfa8938e61c08a41a947559be39c7dc3ca018ef2b660323ade4a36ce8e60370d611c0d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884607, "uuid": "3f8474cf-df0d-4346-97d2-bb362bf6185f", "value": "T1DFC32A50BC41AA92C6D7A27BFFAE429C371603A4E3EE7107D8345B95778B0160E3E985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884607, "uuid": "10255932-342a-4079-973e-8e8975c21e4c", "value": "1536:Y3+mdKsd5F8WPQesBly0DGjtzznAmZaAtaz7NC1MgUDSe0hsv/tSvU8ndo5K:Y31ANg0DGh7yz7NCGTDZuIVQU8nm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765884607, "uuid": "3594a008-9dca-4420-a904-a599559f93e2", "value": 121656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765884607, "uuid": "62e30034-26d0-45cd-8d1a-e3aad6c31ad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884607, "uuid": "949dfbd1-ebe8-4624-9af7-9ac725694d6f", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a76c699-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879841, "uuid": "1665a386-f1c8-492d-b801-21a84f4a1ba8", "comment": "Malware payload (Rhadamanthys)", "value": "b45ac624d6d195f4a17f68f1fd41966d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879841, "uuid": "b5af4b86-55f7-45da-bcb1-bc957e572f1a", "comment": "Malware payload (Rhadamanthys)", "value": "841d49597b99aceb0aff1dcbe71659fb3881a37606688d02bc618e223cfd0be5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879841, "uuid": "6b836c26-2bc7-4d83-8200-04cfba189c1c", "comment": "Malware payload (Rhadamanthys)", "value": "25ef694db8019503387c2eb2267ab3df96eef367", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879841, "uuid": "32c9dec1-4b40-4f51-8617-df5b08cc58d4", "comment": "Malware payload (Rhadamanthys)", "value": "8b4dd67b61378fc4009c40a0222663a69d2549bfbb18c677d591cfa9bfc469c0e479caba259a0438dd63b35fc2544101", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879841, "uuid": "a52507a7-e529-4ab9-b846-bde0d10cb157", "value": "T14C9306FE5B83C0A450A2B1C96DD47B688C5D8943835CB324A90BFB5146EB7333B26693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879841, "uuid": "78cb9df9-d95b-44c4-abf7-c97c22fb666d", "value": "768:GDhd0i7J4sYKgY/CMNfWdIyHG3z70Q00e+igZak1q0BRQUcPdirAXZAcmDNsyfrP:GDB7eKg20Wrurld6D/AvB96BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879841, "uuid": "7607567a-32dd-4ba4-9a5c-78b44ea164bd", "value": 96838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879841, "uuid": "7a4277b0-7ebd-4f15-9f95-c33805a7b7f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879841, "uuid": "5f5f442f-06f4-4cbc-aa9f-a800894bbdff", "value": "invoice-1637482117.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6013f277-da86-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765893112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893112, "uuid": "d9b557d3-f948-401e-ab06-3ca48f20ada4", "comment": "Malware payload (Mirai)", "value": "aab0b7813043c3e7a815b15757661942", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893112, "uuid": "66b0c91e-6716-40b9-8346-d346d8bfe70d", "comment": "Malware payload (Mirai)", "value": "8422e5908ff7f76b973a9894a3da9333b7a5a9a17beafdbd98926c4bc77f0400", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893112, "uuid": "3a191242-25b6-48bd-b8ac-87f0ed0fdfc1", "comment": "Malware payload (Mirai)", "value": "085bae2119928a7bc7edd6f9e082ba4e1d9842ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893112, "uuid": "32cc0e73-8316-444e-912d-34c05a060cd8", "comment": "Malware payload (Mirai)", "value": "5070a5ea9d943841a05bba6b6eedc27b1e295ae74370a05a9be7db3d095f0923ed302b87c9def043014e75a635654d66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893112, "uuid": "057aef18-fe32-4b7b-b6bb-6cb804b0d470", "value": "T17E242945F8818B67C6D523BBFB6E428D332667A9D2EE7103CD215F21378A85B0D37A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893112, "uuid": "f5017d5f-064e-4c87-a752-f1e78db17072", "value": "6144:ATY4v3wa5mLGycwx/eaPvq3RzIx8+sXMSiU:ATlPmLGycwJ5nYzL+sci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765893112, "uuid": "f3225261-10f8-4ab5-9b40-821c17bbf8ce", "value": 223976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765893112, "uuid": "a0b56e5a-3f33-4f35-88b6-b4a965a4851e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893112, "uuid": "e1e64890-6cd9-47fd-a8a5-ac2349670dbd", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790add19-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765852781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852781, "uuid": "1f67260c-bc2b-45c5-b8ff-3385bc2e4480", "comment": "Malware payload (Mirai)", "value": "798ad31a8e193e88a77b1c0298037575", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852781, "uuid": "2c38ef62-f529-4f60-abc3-09be2d45e9c9", "comment": "Malware payload (Mirai)", "value": "845cdc011d0e69e2c0b12bbdccc80810d9842dcbe7dbc22d9612c5ecde648305", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852781, "uuid": "3bd630db-0166-431d-bb26-4b6485b3ac71", "comment": "Malware payload (Mirai)", "value": "50b7b81d505c01106eb9fa2f107bf8ce1e1130b5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852781, "uuid": "338f2e2e-2f4b-41c7-aa70-426705cc378b", "comment": "Malware payload (Mirai)", "value": "bc9c590e4a32ae4c74797493c34390c1f98fdae553d17d6d943ea7157ea8243a9a005dcaa8dc14a9198d68331a11883b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852781, "uuid": "ffdef9ef-b861-4e4d-b830-1300aae36c11", "value": "T1C0411DCB2196A7796C64DB63366A55C470F0E8EA95E5AF1B9CEC34F6809CD072430EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852781, "uuid": "5f2e14b9-2535-42be-89a1-d9badd2c2b51", "value": "48:vfO9abjhKZBe1/6HPNc5ys3ekS3AF3Mulomi1JWPLZcRLEtBJfVQq:vfSa/hWBeV6vNYlS3A9MuljiTWDZuLET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852781, "uuid": "a3b818ee-ea04-4199-ac6c-b9ef57ef4668", "value": 2014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852781, "uuid": "794d721e-9fab-4860-a162-e88b1b0949d7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852781, "uuid": "4fb14fa3-e1f1-450a-ac02-20014a38ac88", "value": "Fantazy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4ea03a-da7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765888592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888592, "uuid": "bafcb958-44af-4a2e-8f0d-732a8f4a973a", "comment": "Malware payload (Mirai)", "value": "4a5f378cf24d67703bc1342f6c6cbe5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888592, "uuid": "17f89611-86b4-4405-9675-c73720122d7e", "comment": "Malware payload (Mirai)", "value": "8527871bd77095d127dd1842a1f066322683fc3e2e361c92df2161cc3c88c243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888592, "uuid": "c9fe3230-1900-4372-a5c1-3007281bbc4c", "comment": "Malware payload (Mirai)", "value": "a08d0125453821b9677bf2d2fce6f9cba1a6ad7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888592, "uuid": "a444742f-45f3-4182-a72a-477f07a6a80f", "comment": "Malware payload (Mirai)", "value": "3ad6fc110a43469ebd4a03eb2df0d68d98f7a33253fdade693e7d887e5b7b3440f2a48907d3bdc4fee9a8b895ac09c04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888592, "uuid": "d7bd48ef-a976-4722-af17-c46f54629162", "value": "T147B37C2190099FE8E1A92A7464902D3C8B132C01A55B2EFF9FF644B78487DF7F50E362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888592, "uuid": "8bd7d762-b6df-47fe-8482-66b643c1277b", "value": "1536:l/SJboz57xvoaxxLP3Zf4SGz75QX1wnUtM/5UrbyYCsj4TeCaIV:l2olZfxxLPpf4SGz7etMBUfyYp8iC9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888592, "uuid": "546f2070-ca83-478a-bb1a-eae1e59b04d3", "value": 108460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888592, "uuid": "9c450b7c-3276-4dd6-aef7-242c67ed125f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888592, "uuid": "f4109522-8380-4ebd-af41-1dcd6237c620", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ae08f7-da89-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765894619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894619, "uuid": "3c56bb19-4b05-459e-92b5-230a2bd3ab94", "comment": "Malware payload (Mirai)", "value": "ce9cc8a712707c939ad1709dea22e90d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894619, "uuid": "53d7ce76-71fa-485b-9921-933e9d6ca12d", "comment": "Malware payload (Mirai)", "value": "8603ec192eeb21e03c18a2dce70a02847613ddca6be549aec315aad0adf10722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894619, "uuid": "5d39f38b-358d-4da0-90ae-951d87102383", "comment": "Malware payload (Mirai)", "value": "267fb8c5f780f8221bdc6628591ed711a2eefce2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894619, "uuid": "c17a3c67-61ee-498b-b2e6-877e1fbb692b", "comment": "Malware payload (Mirai)", "value": "e84adf15c0b681cb9419f5934f3d06754c91a6fbe526af274450a7b2f6f1089f1d5bd6662864cc0655afce426cd532d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894619, "uuid": "2c1695fb-c73e-4c22-945c-6bd7d735e9e2", "value": "T162B31891EAD3C5BFE825013551325B328634FB3E907FEACBFFA89930AC1024195597AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894619, "uuid": "3d0ad3af-c8cc-4a50-ab28-d9a45b6e472e", "value": "3072:bf7VetgGp5fVat+A/wyCJ4QPEuw5XhZZHZaoD:bTVupxW+AbCJ4Qcuy7Hao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765894619, "uuid": "5b04adb1-5946-46ea-9dc7-5477830fda12", "value": 115664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765894619, "uuid": "f1dc5cab-845b-45dd-84f7-443b9806c7eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894619, "uuid": "bc7cc89e-0f0a-49bd-bc72-ac8251809fd0", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81bf2bd-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879596, "uuid": "c61c71eb-c9ab-40f9-9a93-fbf4df50f9a9", "comment": "Malware payload (Rhadamanthys)", "value": "88b59cc657c03bfd66b130b98ab317b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879596, "uuid": "8d3adec5-f333-4ad5-9799-5c88b7a74684", "comment": "Malware payload (Rhadamanthys)", "value": "8605e58c34b2bb2155334c03e77577f70a1e673dcb356e84147cdc6c56c91083", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879596, "uuid": "193d7932-b50a-4e21-8172-015f3c8c0dd3", "comment": "Malware payload (Rhadamanthys)", "value": "7c5ce27f9e4531984c9ae6b14a49086384358895", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879596, "uuid": "352dc531-04d9-434d-b8a3-de77dc28475c", "comment": "Malware payload (Rhadamanthys)", "value": "a9b4d87c7758c09e8252f0c2018ec03838156522cbce18777892851117d2c43a961fc8b9aa70e88885dc3340c404a447", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879596, "uuid": "96c77473-bd74-446c-ab64-08dd73ee045c", "value": "T1ACA318036BD268C0CC802BD55D6B0ABCC941C79E3C2768FA5D73BB29DB417A841975EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879596, "uuid": "b180f5a0-7d42-4650-908b-f8c7cff1cdd0", "value": "1536:GDB7eKg20K21anowhWMCPoxfcNoc0MOO8nY8ASC3B2rMxg3rbRSUepsHhsGt3DnI:GDB7b0kRBENGN6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879596, "uuid": "029f5ffc-a085-4e5d-928f-93effb970e8e", "value": 102671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879596, "uuid": "ca8fa049-5ac0-47f4-9c61-63a96d3a14a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879596, "uuid": "16d584c3-8311-4d80-aee6-1bcc19b67d3e", "value": "invoice-1637482117.pdf (71).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a676455-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765895706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895706, "uuid": "3ea83395-0e8c-4f10-8d8e-4d16912d10f2", "comment": "Malware payload (RemcosRAT)", "value": "efb7f65dcc2b22f35512f3a1a6e09058", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895706, "uuid": "285cf2aa-0aa8-4274-abc9-0f091a9776c9", "comment": "Malware payload (RemcosRAT)", "value": "86739eb4f744f7a50d147b5cbc341395123ddb36071fabd08c5e7f47fcf3021a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895706, "uuid": "e089c3ef-a8cf-41d9-817a-886a4a934b88", "comment": "Malware payload (RemcosRAT)", "value": "6c1a0f427d8ef473259b2f325779846ce1facd99", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895706, "uuid": "ffeb1318-94b4-47e2-8d8c-22aa8b1f2244", "comment": "Malware payload (RemcosRAT)", "value": "39e8d24c488030767aa8abb04b8f69694afe3b07ed863cfef03527463a00034e4060415260cf81a8636dc9d29712ffe1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895706, "uuid": "87975023-7f87-495e-9c4f-66e2f97e9ae9", "value": "T140E2E138214609DC60A5F280E9AED79A6158FA208F731E0751566F5F4E5C1D1F97CF38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895706, "uuid": "5a594fad-3b35-4fa4-a54d-7d8fc89409ce", "value": "768:Dmg/uqq1k2x+8pXks06Id0x4ijbiLjztCPkNZdzxwz0s:DW1kqXjN4IbiRCcNZ9xwzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895706, "uuid": "08ed41b7-f32f-4567-869a-0fda77a15235", "value": 32883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895706, "uuid": "14cd8601-c558-4b7a-9cf4-6c827fd81d94", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895706, "uuid": "eed33139-491d-4f7a-a20b-9af361b0137f", "value": "Bestellung 262107646552.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8e08ff-da6d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765882392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882392, "uuid": "80ad3560-8dc7-4a97-8cea-1e8bcc3e1d86", "comment": "Malware payload (Mirai)", "value": "8056683b01739b31fa200e95c5a114fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882392, "uuid": "0fe2b58d-3a72-497a-84d3-5e9a42e3df4f", "comment": "Malware payload (Mirai)", "value": "86aeae3058d59f9d30bff784a0f2b10603ece476f551ca652208a55edae625b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882392, "uuid": "ad5fb896-cdb8-47c3-89f1-7bf4f6dfd632", "comment": "Malware payload (Mirai)", "value": "7a819ec4cd56db47357559cbfb27b4101133136a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882392, "uuid": "8dd4d71d-9582-4896-a6f4-899c8ca8ddd4", "comment": "Malware payload (Mirai)", "value": "a719370952832e308118bd36c5b42a9ec3a41f2d2a6392aa06d35e8d8dab65f22c3df70ac4d68bd4ed04e8dbd1715feb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882392, "uuid": "552d5f60-e640-4d97-b13e-dd368a71b65e", "value": "T10BB38F328005AFECD1445DB568A04538C326A601B65B2DFBDFA78DE181CBD9BF24F366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882392, "uuid": "6dbd66dd-da77-4061-9fd8-3bdca8b578e6", "value": "3072:IZsbwVh60DLdSpl6FLEgibcM+GTbCiKVK:IZ/1sSFLnwcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765882392, "uuid": "2c701ab5-b815-42ad-a4d9-58e67b42ca1a", "value": 111804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765882392, "uuid": "0f784190-9152-4cef-b2f5-10bd0d3a9de4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882392, "uuid": "a9875682-8782-4d62-8460-f5e08a4ebd2b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe473aa-dab9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765914908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914908, "uuid": "7cedc0ba-35a5-4982-ac03-49681f5d647e", "comment": "Malware payload (Mirai)", "value": "ea3d6ed71fb8187daa0fffa2fee517db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914908, "uuid": "2c422d1f-72aa-4e46-a323-60c7234e843c", "comment": "Malware payload (Mirai)", "value": "86c66fdb1c7f3362796fa58500025e710197edcd942e2cf09857d35b91211cf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914908, "uuid": "2571cee5-865f-4a42-afa8-8f0cd698e3b9", "comment": "Malware payload (Mirai)", "value": "13f1b68018104097f3dd9c2bda54e819f873f350", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914908, "uuid": "6ed30286-abd1-4a24-b886-46c4a86a5da5", "comment": "Malware payload (Mirai)", "value": "f705aa2db354f6a6ab6cbfcfe677e30b9bf2b1fd80d7f99fac76cfdf8d9ae57882761c082f07eeec1e3ffd45e6dff212", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914908, "uuid": "2e3e5b36-e900-442a-854c-1f314683f616", "value": "T136F3B64FAE609F7DF2ED937943B34F20DD5A22922AE1C5B4D1ACE9005D70318986FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914908, "uuid": "b5ec0616-dd64-4d76-9671-6d895ad20945", "value": "3072:SewikGm4CugaUx0PlSaLi3dtvpKXe0IDXEBoPba+ZTLQvAQamQk28aV3I73BoYP7:SpikGm42usEskAR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914908, "uuid": "30a08d87-4ea5-427f-97b8-4f730ec3e967", "value": 163784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914908, "uuid": "fa6d2c4f-d1b8-48e5-9179-1d0022966730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914908, "uuid": "e7a909db-16f2-4b5b-86b9-b3910a92c05a", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b962dddf-da9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765903569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903569, "uuid": "1070436c-3501-461b-b1de-360bf55095bc", "comment": "Malware payload (Mirai)", "value": "54ca30a3d9ce93b6f2885f3ec307d14e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903569, "uuid": "e597e346-2ed5-415b-9f16-255755f5efd3", "comment": "Malware payload (Mirai)", "value": "8785255c6ae779cf3e016558fb0f6a1b8fd910e20c6a8fcb04151aa6f19d5a5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903569, "uuid": "74cf1bbe-7345-4fc1-aa1f-78ea703da644", "comment": "Malware payload (Mirai)", "value": "9d113399200df11ac98b15d3aa7bf88e55c74d98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765903569, "uuid": "8eb05ec3-a9a1-4caf-860a-246dda897d7c", "comment": "Malware payload (Mirai)", "value": "cf8d0fcdb8fdbc885ce839ecd84688fa59bd35a22852a88879242a36c4a48c1051bf109032aca02b1cdbdc878fe46237", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903569, "uuid": "ae029286-2c40-4512-815b-d3ddd068ae1b", "value": "T105C34B22FCB63E37D0D0F0BA51D38235F5B6570A10ACC719BDA20DDC9E395A4266627A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903569, "uuid": "9d275de0-c156-4748-831d-ce40dfcdada7", "value": "1536:CuWPhSjXloed4nPXerSy/+ZeVsVWE461kdcf2ZkPft039WFeqGB0SEbPgzd9/TuE:CNwv0OwLr1kakkzM9aUXZjABkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765903569, "uuid": "b097f766-43d6-4150-9cfa-9151a5488cfe", "value": 124124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765903569, "uuid": "947d72a9-05e8-4195-9d5c-ea10e2520d77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765903569, "uuid": "df4c2f7a-3f38-4b12-8111-685c9bd0adba", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6be7ef9-da5c-11f0-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1765875218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765875218, "uuid": "1ef1aa72-d407-427a-a92e-a005f733f59e", "comment": "Malware payload (STRRAT)", "value": "50f3fed1db2aa1b09b443ae31480ae4e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765875218, "uuid": "921f1029-3c1b-4191-963d-aa129cdb2d73", "comment": "Malware payload (STRRAT)", "value": "8796ecc3ee04114913feba910b81a37c5ea9c90b3c781a21817e6634d0563704", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765875218, "uuid": "fb1e0ebb-07a9-4984-822b-dac40a86dd2e", "comment": "Malware payload (STRRAT)", "value": "1c2919d982bdf2b5eacb5f35b5c2b43d322cf9b3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765875218, "uuid": "8b30debb-fb9f-41ba-905e-dca0bdff92e9", "comment": "Malware payload (STRRAT)", "value": "0f7a2cb173797b84cf59d7943d5263e20e3b391799204db5983c1b11e8e85847356770a82183e1156180c02a39270185", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765875218, "uuid": "ff222709-469f-431a-af91-a8ae1f39bbfa", "value": "T15A24D0103BA19879E263A0B24A49B305FD71D1BFC26DB1970FE1EC2FDC568442F0AB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765875218, "uuid": "06a46044-073d-4050-8ea9-524333607bab", "value": "6144:6q35wb2on4rdTiquCeeUIC3lJJySh/tcQpURA+Ocsy:n2L4REC2IQhqydcsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765875218, "uuid": "867ca0b6-109f-4569-8e84-37cca0233e9c", "value": 211928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765875218, "uuid": "6672d89c-e3aa-4379-8ed4-b49cc6dcef46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765875218, "uuid": "aab1ae95-20bd-49db-99b3-002a0432a245", "value": "TEKLIF-FORMU.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1266fd6e-dad9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765928629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928629, "uuid": "e5608a45-e519-45e5-a7ba-ff034afda5a9", "comment": "Malware payload", "value": "9c0e843faed7901fd93151e4b969928b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928629, "uuid": "0b202721-bd74-4a3c-b746-feec2e5c6cc6", "comment": "Malware payload", "value": "88585c3558cc7ec68ca9a1e268771547b00a057c02278493622382aec838b5d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928629, "uuid": "ca90dce5-0d8d-4ec6-b20c-977f7edcd94a", "comment": "Malware payload", "value": "7a02f561d19883c466de9cf7944bec0473d63f76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928629, "uuid": "5b144923-dab9-4fae-969f-c2b6391cb034", "comment": "Malware payload", "value": "baca4e6b9f1200fb8c2280af538ac597dffb5934aeb34bb1db22f0650b957e1e1b525fe24c9f08a7855202ce4f44df80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928629, "uuid": "32a98c62-e368-46df-926d-cfc56bddc0fc", "value": "T190C33901BE418B22D6C7727BFF9E439C332A6BD4D3DE7607A8606B54738A4270D7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928629, "uuid": "228bbd62-3d78-4ab2-ac20-d148cc33d64f", "value": "3072:zoTXoIik1+WGlNgOY4yTfIdXBO0pIJgbVkMUm8nX25:zo0YAHY5cX5IJgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765928629, "uuid": "5a89bc5e-f23a-4c95-b9e4-dc0aa5fa5507", "value": 121212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765928629, "uuid": "68a41086-ed4a-4837-be64-cba4eb7a7bab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928629, "uuid": "263b547d-f1aa-4e29-8fba-67ca988f0b69", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8dc2963-da7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765888590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888590, "uuid": "457090e2-12c6-4774-b2b2-c993a1fac3f3", "comment": "Malware payload (Mirai)", "value": "985e77bbbb0ff4909448f83f4ffc635f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888590, "uuid": "cb7a4f90-a48f-425e-9757-8791447543b4", "comment": "Malware payload (Mirai)", "value": "88842fb2c8779bf824b9774f8426769f8b0b1253a872e6df82ef71fccb2ed590", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888590, "uuid": "46a58bd6-2694-4dc2-8298-cfc81c793961", "comment": "Malware payload (Mirai)", "value": "c0b2666c3ccad3c68f2b1c57f8a0a45c1e201d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888590, "uuid": "3a0975b8-84c2-4793-a2ce-f147be680ec0", "comment": "Malware payload (Mirai)", "value": "5818aef2ef468878cd6c241db51e45a0b2ce74244c3545d107a79c29f214ce74d22d393e45965aa2cccfc3710444c640", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888590, "uuid": "3dc453c2-b963-4b06-b99d-fe9f094737f1", "value": "T1E3E3E90FAE219F7DF2AC537497B74F24CA5912922BE1C5A0E1BCE9016DB030D586FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888590, "uuid": "2273399a-8a12-44f1-91c2-e60b7cec7b74", "value": "3072:/oHG/5y6usKc9cjlKqPOTzxjSmfWA0X3yV4rgiqKv3sT5g6SUEM9j93l7vpo8XC2:/8G/5yrS72JqtwH5Hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888590, "uuid": "438fcfc7-90a9-411b-900f-01a4395d9d12", "value": 155508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888590, "uuid": "42659d3a-8793-49fe-baf7-905bed43101b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888590, "uuid": "9997dcb8-9f4e-4301-b102-10a19eb56ec0", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5edca7a-da86-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765893363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893363, "uuid": "a7b1c5db-5e11-48e5-ba13-dac5da286231", "comment": "Malware payload (Mirai)", "value": "34f77ca4b1ec1d725c27e34f58045b34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893363, "uuid": "5b3aa339-e43f-4561-97e6-ffb3cd5205ac", "comment": "Malware payload (Mirai)", "value": "88e54ebb8a8843396c8c0863b59286fee7961a7dfbdbd9418ea7bbb1ccf0a9e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893363, "uuid": "59a1f59a-767a-43c9-ad03-577462b3ad21", "comment": "Malware payload (Mirai)", "value": "b22cb08f90398d368be6e4474a4546230754915b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893363, "uuid": "8e767ff9-b548-4c5e-bdb2-e9b167778113", "comment": "Malware payload (Mirai)", "value": "f24eadeacc92b8d82f8b1e225e4e5b92217e823e72f48962acc677eeeb15084c3de0a96e71c3dec27500043b08319613", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893363, "uuid": "82553bb6-e5f1-460b-bcce-7844cfd077cd", "value": "T1E3D30765AC418B15C9E733BBFE5E129D331313A8E3EAB026DD141B9577CA01B0F3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893363, "uuid": "e0ee6cb2-1f27-4c64-87a7-f9d498fe5e8a", "value": "3072:a6n54ebCPgdsPG3YE158M3LhIoS7u3KkiyvehYVnp5:a6nGebYgdsP21+oLhIoS7IKkiSeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765893363, "uuid": "eb7766b8-7dae-4752-aeb2-7a3bec961b21", "value": 141100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765893363, "uuid": "d42c3383-206d-4d9f-9da1-821a94bcb444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893363, "uuid": "fe0a798e-07d0-4c4e-b96f-474ee60db1c5", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce50b010-da6d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765882559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882559, "uuid": "cd1a23cd-dfce-467f-89ad-4bdde25132a9", "comment": "Malware payload", "value": "ab7bf4f47d553d82e8eaa9b9abd88345", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882559, "uuid": "c1c1c81e-7f0f-44a0-992d-85ac3a9c5d0b", "comment": "Malware payload", "value": "8a288a0615e6e426fbfc8e88ee9020964e80931064a1034e716a1fe17f79b89d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882559, "uuid": "93d103fc-44cf-4e83-9390-94e487d7b9f6", "comment": "Malware payload", "value": "01964613eb64c8c61fcebcf320f1765717bb29e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765882559, "uuid": "f6d589ef-c65a-4c9d-bf0b-2f71ae948a97", "comment": "Malware payload", "value": "57a867c1f4611aa57930cf526169c25b3ee52bb931a251d9d342fd8095ca17e4eee4effbe3ca6e531db54aaefd698f95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882559, "uuid": "c81d5ef2-a961-4fe4-96fb-01e6d9936468", "value": "T1D8564B03EC9555E5C0AEE6358A629213BBB17C481B3073D72BA0F7282F77BD06A79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882559, "uuid": "dd590174-b8e3-4a2a-95f1-5c07a2fbfd04", "value": "49152:Qm+T95m9yb8+JRUQ0dyct49aT0+1zq3UDOttUVqclqzLmInLFKzowcITZmEoT519:QxhwOyG+83UOtLdJ5HuBvaE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765882559, "uuid": "e4c192e5-cdb5-4afb-bb10-d20aee1d71c0", "value": 6414520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765882559, "uuid": "ed63afbe-83a0-4f00-8537-8c27ff28670c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765882559, "uuid": "8dd75076-d318-4865-ac5c-817d6d2e6bbe", "value": "update.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37f9439-da81-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765891077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891077, "uuid": "0f3f9b18-04e6-44c6-b790-3c063df583ed", "comment": "Malware payload", "value": "86dbb1cd4c4b5b5930a73b117faddfbf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891077, "uuid": "5d4d5970-d0e9-4a2b-9bb3-ffb2db4865e4", "comment": "Malware payload", "value": "8a34cbca109d3a375b601f9b6d327f04ce96a18dca59456b84c31292f2529af0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891077, "uuid": "2f49df5c-7bd3-487a-8eed-8dddb256e50e", "comment": "Malware payload", "value": "4e2dc654ec6711588159a7e10e44f596a16a15af", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891077, "uuid": "a69d9598-fdc4-409f-95d8-18982da572e8", "comment": "Malware payload", "value": "29ca84f211faa950c7578c90b33d29769a1af159bc4e801b0755d06e754c9a031f9b3ab40dad37558b2211ef92a3be94", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891077, "uuid": "00146218-0f1b-4384-841b-90027e82f1de", "value": "T14341693705C3F72BF095B25FB28F4830A262A17F412423EAA23572300D45B285EC99B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891077, "uuid": "302b0381-c538-44ce-9368-7956e20561c5", "value": "24:ZROEyiMnHwZdXS8dFZ8EfxwiS1Pb3KNHJklyRmb1Pb0jjUWqm:nDMHw/XSgFXPNpxRyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891077, "uuid": "acfb5234-a0f0-40a4-94f7-0e1c08e5d25b", "value": 1985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891077, "uuid": "53aa707d-a7c8-46d4-b2d9-bc5f32c6e2fe", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891077, "uuid": "15b3cd05-145e-47bd-a88f-f7b123befaa9", "value": "8a34cbca109d3a375b601f9b6d327f04ce96a18dca59456b84c31292f2529af0.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f9a492-da4a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765867196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867196, "uuid": "68549464-fae5-4423-989a-1e5bcda369f4", "comment": "Malware payload", "value": "8ba7806b911c14cb0a64ecde22929005", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867196, "uuid": "f3c3bf97-bcc0-4642-9dad-c731cdd6cf30", "comment": "Malware payload", "value": "8a8723660c7539936d62becc34cbd05213cb21664b823ab648e80714ed6819c5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867196, "uuid": "25272f6d-a41e-482a-a2d1-3fca3a0a1c03", "comment": "Malware payload", "value": "b2f14dd057b49db9a0e9f75a4750b92b900f499b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867196, "uuid": "981f3062-4660-41e2-a5fa-5a4a75832b43", "comment": "Malware payload", "value": "fbc44599ff1bd52f064a8f9071aee16257f60e01154604ca7a1f1973a992f416f59d9b7b6c0aa9ea2fcbbb0b1e579b25", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867196, "uuid": "6bb26dc2-6025-4209-8879-93bc16b06699", "value": "T1FE21F1115FF91B15E3F64A3A147A7335DB77F406A6128F6E008502880862B01AE78F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867196, "uuid": "1eae03bf-f3d3-4882-be51-12c2bf843305", "value": "24:8kbJ+mjJiZJeVJfNgAIvm6Ji+/x4dTP1sYqVKF6Me6wabpuTcmf:8UcmjwZJeTN3YT4d7uBcMCwatWcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765867196, "uuid": "e7082ca5-3be3-4a30-a25a-8f3e46575b11", "value": 1393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765867196, "uuid": "511501f8-e7f3-41af-85eb-9386207f240f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867196, "uuid": "54196494-08c2-48f6-bcb9-b47803980258", "value": "8a8723660c7539936d62becc34cbd05213cb21664b823ab648e80714ed6819c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2da119b-dab3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765912578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912578, "uuid": "b16dd725-0409-442d-8d59-39db0a2cc77e", "comment": "Malware payload (Mirai)", "value": "de9ded30781c4737e06723face017ddb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912578, "uuid": "d02fd0dd-dc3e-4ad9-a6ba-bef4bf192a74", "comment": "Malware payload (Mirai)", "value": "8aa15f89ee036a0bedfe039927aa4a347052998537aa45a788d9fb156d0c912b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912578, "uuid": "60e24455-8002-4af9-b03c-bf3f35f4b682", "comment": "Malware payload (Mirai)", "value": "f18e7a4acf8206dcf329d096bc229e134a04db31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912578, "uuid": "8c96fb21-9b1e-47f3-99a6-b8846f9eec93", "comment": "Malware payload (Mirai)", "value": "7fdae0f6339c63666cf7f31690287c084c58f52cc2fb537f7adc2f553de8cd233eb6646c14a48bc8a99e74d84faaf5b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912578, "uuid": "dfed515d-81aa-48cb-a85b-408550ff917d", "value": "T1C5E30745AD409B25C9D722BBFE4F119C331243A8E3EE7117EC185F56B38E91B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912578, "uuid": "1008b2fa-6bf1-4156-90c8-f5f5824cb807", "value": "3072:fISxsYY1IVRYcVdHG22LjwN5ad9M2ru6qgfdKT6oQVnKz5:fISSYYiVRYAmRja5ad9M2rFqgfs6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912578, "uuid": "f33f47a7-93f0-4868-81f8-9b895d901c54", "value": 144744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912578, "uuid": "e3272257-a9d8-454d-af8f-d4a717ea6e72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912578, "uuid": "30ea6c64-decf-49d6-a581-39722759be34", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c93ec3-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765879292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879292, "uuid": "2f6d3f34-d4af-4ff0-a525-bc0f045997b9", "comment": "Malware payload (RemcosRAT)", "value": "0f13859b7538927d1cc20cbdaf97188d", "object_relation": "md5", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879292, "uuid": "e947f4d9-385e-44e5-a3d1-2a6a0fafedac", "comment": "Malware payload (RemcosRAT)", "value": "8aaf0a504fadde8d8d89c879c776d1b34dbe8c06bfa7f9a5aeab001c8ba4a6e5", "object_relation": "sha256", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879292, "uuid": "be2cbc8f-5112-4ddc-8911-7918752d1ed7", "comment": "Malware payload (RemcosRAT)", "value": "32ad0cb4f86aae8a350e76784839f41a607c9998", "object_relation": "sha1", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879292, "uuid": "32c77511-bb3a-418e-9639-1b69509c6c02", "comment": "Malware payload (RemcosRAT)", "value": "60ee94cdcaeadc543a114e9328b37b1cb522aebc3617ab5b6a6b19eb4bb4b08d1c6666098b508c6c140c18ce73d7c71d", "object_relation": "sha3-384", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879292, "uuid": "617783f3-32f9-4530-a762-28c449715dcc", "value": "T1CB76F87335DB609239ABDD5A27709B209C433A33385DC91CF1F4236624E5E15EA36CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879292, "uuid": "a7ef4d95-9b53-408b-9186-56d6b0e4c70b", "value": "24576:4HoIxbQYUGt0AOnej/O7Ll8+QCCNoO1M9IOYOMxtyLtgyL5QOAZ0c8deNPjFVJsz:qoLC2Mi9uqexFVJG82v6vPF3Py0+wcTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879292, "uuid": "106d3185-93a2-455f-8cdb-7dd1c7e46b44", "value": 7421732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879292, "uuid": "2b907e5a-2974-46ab-afca-f15f80136cd5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879292, "uuid": "3730e8f2-2ab2-415f-a4d6-29463dae924e", "value": "ZECH_GROUP_SP_PROJECT_ RFQ_SPECIFICATIONS_65486_pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03885ef3-dac9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765921733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921733, "uuid": "f3f383a1-4d0e-4374-bae9-61fb4666946c", "comment": "Malware payload", "value": "34bb85c8ea2a26c6ca3fc3a7e837446e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921733, "uuid": "384538ec-bf20-4605-88ed-0e383c07754b", "comment": "Malware payload", "value": "8b285bfafb3e876e29f04165896276d17f0998e2b02f97c90a28c34ab53ee866", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921733, "uuid": "cc2d6f6d-6cf0-4755-8b87-9b9b7b5b52ec", "comment": "Malware payload", "value": "0b8350f2209d6d685e7ec9e560a0dbb9a64be0b4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921733, "uuid": "893e00bf-2e1d-4092-bcfc-ca6a29450ce9", "comment": "Malware payload", "value": "e1a8f3d3540f9b386fc55b07d1d1a5936222bbe1e42fd174c1633fba7b9b6c8848671070415cd31d2f11625903d422ea", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921733, "uuid": "b91bbc5b-df03-4273-a5ef-5af50ca36a50", "value": "T1BCF533115F2D4C7F0E6C4759622A5F1E57E4CFC1CDACC4F892B638CA219FB86904B8A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921733, "uuid": "406da92c-8440-4462-9a94-36b02d67644b", "value": "49152:BaRos578wMXShap0xicL7EQQQ4UvnrISqeQan13U46/tUh:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765921733, "uuid": "5d0a1d2c-a0e9-49e1-813c-db1b59e36b4d", "value": 3377565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765921733, "uuid": "3a5d5623-f5d9-4704-b240-44f8ca680934", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921733, "uuid": "e93f0cdc-6824-4ea2-a340-de07b43e6694", "value": "WindowsUpdateSvc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfbe661-daaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765908567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908567, "uuid": "d6fdef1a-ee83-437b-a23e-9a44f499fb70", "comment": "Malware payload (Mirai)", "value": "f469634cab67801a8074683853e15649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908567, "uuid": "59f5989f-7e74-4891-9735-659cf67dd453", "comment": "Malware payload (Mirai)", "value": "8b4016a05a91dcf18c929a80092ab621a45447078faf91758e35e4a9f862a8d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908567, "uuid": "c8cb0adb-c988-4df3-b26f-aa8c79cd3617", "comment": "Malware payload (Mirai)", "value": "e83590650ac2ec7cae77a1fced63a9a83ee5dad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765908567, "uuid": "e3b075bf-05f8-4674-80da-a831fa6d36de", "comment": "Malware payload (Mirai)", "value": "5d26b2a45bb7d528969ec6d9fde64741cdd190bf9a36e541f2d1e3e26efe627cae9fd1eac0a109a5d88fd609efdb366b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908567, "uuid": "78842099-99eb-4323-8d65-856e9f1d6d38", "value": "T1E1B38E32C01C4EF8F0996EB9EC92457C8713655936673FBE56B988A04483D2AFD493B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908567, "uuid": "d664c0a9-033e-4eba-8bc0-8301a058d6f4", "value": "1536:xASJNxbxJxQj0yVxSq8Osija6HQtb6eZrUpWoRCAXvxYCaIV:xTx/J2xSq8Osija6HuapWoRtfqC9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765908567, "uuid": "8d121959-432a-4d72-81cd-545486e7ea62", "value": 107708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765908567, "uuid": "066c6882-b1c6-4eda-86d7-325eb029bbdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765908567, "uuid": "5e721636-2646-4cff-a433-2bd740e72500", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ac3495-da47-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765865989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765865989, "uuid": "e750d9e6-2ff4-4ccf-9e4b-cde8f78d34bd", "comment": "Malware payload", "value": "967a2d534493945ed487358bf8ec1aa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765865989, "uuid": "9c4d50ea-a7e3-4315-925f-19ef1b30f114", "comment": "Malware payload", "value": "8b637af62772aaf33f74dd23e878d5286baa54375b4d0e8862f1cac8a57108e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765865989, "uuid": "9f9fb54b-5d9b-47e5-bd14-b4cc200eee9e", "comment": "Malware payload", "value": "5c6b5b034f95f4256f296dd5ea0763cd190e8bec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765865989, "uuid": "bb68647b-eec1-46dc-a35b-b1cfa7fc8d47", "comment": "Malware payload", "value": "dd2de45a777575c53e492c02d27ccf8ae0e87a2cc29643c5556b9bfac6a308c587d7dea38e14994924a9bc34321c2b9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765865989, "uuid": "475a29ec-88b6-49e2-8e97-182f408eaacf", "value": "T132A3194AB940AB17C5D21B77FE4F134633678B58E3AB730189181BB46FCBB1E0E26506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765865989, "uuid": "c3ff8954-32b2-4760-9176-00ae225722d0", "value": "1536:6PnH/ZofxLcfHZqynRD0KKp5RG8C9CSf3f0JyelPy/Ai43Z2e7x9GsPg9+gkbmsH:y/wy5qynkW8C9CSfPfO3ZxKc1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765865989, "uuid": "8e5d8e96-896f-4f13-996c-46802bf9aaa5", "value": 104903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765865989, "uuid": "bc1f1d3e-0091-4f38-986c-a4effeb1f05c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765865989, "uuid": "2e82e31d-7ea5-4f36-a6d3-24094c02d8bb", "value": "n4t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddb25ac-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765905214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905214, "uuid": "ddd196fb-ac35-4a06-aa85-b71ed7915b69", "comment": "Malware payload", "value": "1f8f6e3a8afc674ced2fb77e03447372", "object_relation": "md5", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905214, "uuid": "be305fe9-3490-46ca-a73d-95fc79af23e8", "comment": "Malware payload", "value": "8be4949f81e0c56a03b039c0649daad0031d7ff67c0fe1b07e5c7fac8cce89fa", "object_relation": "sha256", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905214, "uuid": "ba0d24ba-d31e-4cba-bd55-96247f3fdbc8", "comment": "Malware payload", "value": "41fdc4f8cd7a1fd1e19b8456d56935e31663a249", "object_relation": "sha1", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905214, "uuid": "333b6ac2-082d-4596-9e8b-021f66a65d5d", "comment": "Malware payload", "value": "811c3202f783748ad4cabfafcbf94d6b0d8fe909d13179dd3ae7d698acb660a3cd692574e5493191c030200e1b8b769e", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905214, "uuid": "e3cdf84f-9aac-49c0-81e4-7c1a88d6bcb1", "value": "T14396335B85F31BCAE767F03187A6714DAF6582C8E0C11C726A2542E133C3D776AEB642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905214, "uuid": "47401494-4a42-4e45-9e15-b8ef78242b0b", "value": "196608:yFatExZJ8Ll5RjXdKfaIvw0DKkHYcu5DWiwsaESriXzqx:y8tEvJIl5RjXdG70WjEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905214, "uuid": "2945f04a-b7fa-49cf-a47f-017ac43cc171", "value": 8800668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905214, "uuid": "94f06e77-9dfb-4b57-b75f-c7e1b8760654", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905214, "uuid": "a7d057e6-b477-4aac-aebc-9e47c7940118", "value": "h2n8xaan6sna.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23fac09-da17-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765845629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845629, "uuid": "cb442530-17ed-44b0-99fd-41e2272e7efa", "comment": "Malware payload (Mirai)", "value": "6655349d5fbfe0a5f25adc2d8b902f83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845629, "uuid": "6b830230-cea9-4053-bdf5-05d1c5a86789", "comment": "Malware payload (Mirai)", "value": "8bec1c73f900cafe3dc693f07c34938236391af604c56c2098105c375a872da4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845629, "uuid": "eeee86a8-128d-412d-946d-86eca636e19f", "comment": "Malware payload (Mirai)", "value": "ce3d8a467dbd0b045a329eb870fd8024cd77d010", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845629, "uuid": "47f393f2-ccda-4e3c-b430-5e9b4656cf21", "comment": "Malware payload (Mirai)", "value": "583169af83328b2f7e1f1aeaa9a64b79527ffccd89cdaa7737e3e8852d6e2703e0a77d85deb6f033925d8c406c134540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845629, "uuid": "8e5d517b-1182-4aaa-b793-f29d0bafa35a", "value": "T195B3F755BC85C712CBE767BBF66E02ED735643A4D3EA3107C9104B66738B02A4F6EA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845629, "uuid": "09319271-7c57-4162-9fc8-2ece0ccefa13", "value": "3072:1VdhYCTS0/ozQDa2jzNWwUZngdvc8nb95keNNJ:1V/AP2KngFcCNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845629, "uuid": "0c579707-6835-4f26-98ad-787cb36c5520", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845629, "uuid": "a4a92175-e414-4c9e-b352-cbd729f5c9f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845629, "uuid": "9a1bf108-8d6d-4f14-b1c7-2765650fde25", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4268babb-da85-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765892632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892632, "uuid": "729e1418-e64a-4fbb-85f3-9c40215479b2", "comment": "Malware payload (Mirai)", "value": "89d35283519203675172749abd1334d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892632, "uuid": "f1ba371d-1a9d-4d64-86f8-f57b2bad66ab", "comment": "Malware payload (Mirai)", "value": "8c077300754c363b4c736b03eee309bdc7a1124eb17a43d091b6b703cf9754a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892632, "uuid": "c0405992-53a8-46c5-b13d-849b8219be28", "comment": "Malware payload (Mirai)", "value": "13375fadd97f4c54b0d162f718b4c10d8df38bd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892632, "uuid": "fc5c1d6f-a96f-4b53-907c-2fabcd9874b9", "comment": "Malware payload (Mirai)", "value": "9b0a86881f005a8b9648f3a1e32ae02af43b9ef9a8d9880f0f226ef2007a284f8b013425932843d49918da7430058aac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892632, "uuid": "221df3d1-22a8-40fe-8e51-886d945780eb", "value": "T178B33BC27411CE6DF54FE67AC0EB09056524EA404FA24F2BE786FD936A221A47CE6DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892632, "uuid": "ee16e942-2ba8-4a6c-a9d7-f1dd18a4a26f", "value": "1536:or+XigPhVOEe3t8Oz6Xf82UKlWFic/j88M8uij896AXZDEsY0ySMFv/:or+XifEeL6v8vK8LjlFO64ZDEsjySM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892632, "uuid": "8ca23c3d-675a-4887-b80f-baab97531423", "value": 109596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892632, "uuid": "3613edcd-fb70-43b9-a89b-b75030076578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892632, "uuid": "c1913f36-3d54-43ec-86e4-d1d4e3591244", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac848971-da7c-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765888945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888945, "uuid": "c7a9d936-d895-468e-9fe8-921725d7d601", "comment": "Malware payload (RustyStealer)", "value": "7ae852ccbe9c6541c19600180e714d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888945, "uuid": "3501018c-a13d-49ac-ab94-5adbc3257b6d", "comment": "Malware payload (RustyStealer)", "value": "8ca22fea76dfc4a6895b171c31b16a26e662624f605205de022d7890477456f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888945, "uuid": "907b49bb-bfb6-4a9d-9cf6-f6788d6ffff6", "comment": "Malware payload (RustyStealer)", "value": "c56adc731021d4d62327fa04663848ff264fcb58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888945, "uuid": "57ccc1fe-c4ed-47f1-bf50-13609045b026", "comment": "Malware payload (RustyStealer)", "value": "bb95ca854aaec286f526dc4ca2ea7c03ff02feadbf4ffac3a1df9013fb07b33b9591e993d114166ff525ac2874873b07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888945, "uuid": "d0212208-f4b9-4bfb-b557-743e845139e9", "value": "T12D5612537A62B1E6CAC60074D4BE87340B37813887214AF7B2C75FBC59AA6D06D3A71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888945, "uuid": "d9691493-1433-4c45-a1ea-d55899e3e9de", "value": "1e2d8b9d2b5f4b13181bdaae113cacfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888945, "uuid": "fe94fe85-8e95-4cc1-83d4-8fb907b9af44", "value": "98304:ckpjuyRh1v4MadXBcKamGkQE8WzOuPwsjse1XKGVpYPKa66buuSRu1OJ6/Jxarzv:ckpyoh1BadXBzHGE8WzOm3sGfu+uS3Qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888945, "uuid": "12ea392b-94ae-4363-b654-40343ebef6af", "value": 6115431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888945, "uuid": "89b5c361-0843-4357-9f96-fe769eb60194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888945, "uuid": "4aed9fd1-5d7b-4213-a88a-ff5db28f8e15", "value": "8ca22fea76dfc4a6895b171c31b16a26e662624f605205de022d7890477456f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f003c3bd-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765895930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895930, "uuid": "0c519781-f51c-40bb-8bdf-2ed72a94acf2", "comment": "Malware payload (RemcosRAT)", "value": "782dd0ebf0754fa0a41a4c4b2c944523", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895930, "uuid": "92a52a92-9503-4238-bf30-e19d1ddfab9b", "comment": "Malware payload (RemcosRAT)", "value": "8cd2ac30aa3a2f3b14420b225080e371b1eaf4718ee87972a5ce26eebb74d940", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895930, "uuid": "26a45ef0-28fb-4a0c-9486-e69d694f7463", "comment": "Malware payload (RemcosRAT)", "value": "a433bedbaedfd71e3a888bb14bf828541b99289d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895930, "uuid": "57500f6e-2d86-4951-8f7b-eb86b024b5b8", "comment": "Malware payload (RemcosRAT)", "value": "ae5d63a9ff9df83ea64927b43dc49417cf9f045006422575c94b29d662a5074835e8f0690185654023b1ff0bc844037e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895930, "uuid": "3423b9b6-cb6e-4982-b9e4-c8a734725267", "value": "T1F01614301046255240E1D36E6B2A48B5F6B721A34B62DD94F272D0DF8BFF4B21AB9C7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895930, "uuid": "63d9a864-2036-4ddf-a772-8de95b7112ee", "value": "192:RL74A3y5/68JfgDZWYWmRtcZBtQMmHg58/Rix9x9+bSXLCuLzLoI:Rfy5/68iZQ2cl/ZOJE7QuXfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895930, "uuid": "2e8eb2b3-094a-4f01-96de-0acc274eaa1e", "value": 4221287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895930, "uuid": "467df7c5-49a3-424f-92cb-9c096635a10e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895930, "uuid": "e594a775-dcdd-4f08-aeb0-dae22824ea91", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869ba5a3-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873849, "uuid": "95072ed5-ab6d-476c-bc9c-9c2aef2c995a", "comment": "Malware payload (Mirai)", "value": "2b0e79602a3f09da66286ade2a98da41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873849, "uuid": "8a7320a7-5f9a-483d-b055-f677a103d00b", "comment": "Malware payload (Mirai)", "value": "8ce4c4a94d06c59ee5e7b6a9f6e1d41ba63dfc61eaf06bde51399178ec6e66bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873849, "uuid": "18caad93-777a-4693-8980-658b41f22402", "comment": "Malware payload (Mirai)", "value": "76b8bd9035a1cf4f3d308e41162617feaa6db263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873849, "uuid": "11bc8da8-0f3e-4b24-bfff-519519c71f68", "comment": "Malware payload (Mirai)", "value": "ebdd0125c7cdc21c63f813ddc1da38c2317bc973eb7df074d2e111fda627171b1635c734386bcc9aaed081a20ea9266b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873849, "uuid": "a17b3e54-0343-4b82-81cf-cb818a7e2f39", "value": "T1F4133996F401BD7DF85BE77EC0430A06B531B69551821A3763A3FD736C322985A3AE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873849, "uuid": "33f750c9-7c30-4d80-bded-d72329145a1c", "value": "768:dNG/DAdE46r3a/o92iq++ac2TZdBLNu28t1hmTZ/GttjGJXGQA:dMQLE2fIvBL828t16Z/GfjGoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873849, "uuid": "36926764-4a92-4efa-8891-35365659fe1d", "value": 45548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873849, "uuid": "acbc0b8c-fda4-408b-b9e0-8cd0062240cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873849, "uuid": "6d8a59b2-68c6-4f6c-bbc5-21d8015b236b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11374547-dad6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927339, "uuid": "f3e65891-ed4d-407c-a0f2-3a01f5963d3a", "comment": "Malware payload (Mirai)", "value": "1c01c782e1722c4d7edf3ab1f88afd3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927339, "uuid": "4f841475-d171-4397-83f9-898007f484d2", "comment": "Malware payload (Mirai)", "value": "8cf3168110b1b2d05f38225c2a13489c54a718c091436055245e3abdde6290da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927339, "uuid": "a7c4644f-2691-449d-bbff-346753e2d30a", "comment": "Malware payload (Mirai)", "value": "ea76ebcb0c382746a25ce6ced4becb7e9fd876de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927339, "uuid": "ef34c85d-3ba7-4d43-9427-6e2937909c70", "comment": "Malware payload (Mirai)", "value": "bb8644256b77b36f1499cf00677fbbdb97b2ae7c1b5303879540e557e8532222f2e8286c046bbd96ef8c72c466b6721e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927339, "uuid": "ff4e95c7-ddbf-408c-b8b4-4add512966b5", "value": "T114833A227A355D67D5C2787931F72326B5F142AE82B4C81DFC711E4DBF26840A507AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927339, "uuid": "88b183d0-70f4-4065-a1e4-726708352695", "value": "1536:NcQvoF47/GQsRAdEBkUgsDAr6aCrSrTHCnFd5dttGLxN:RyFRkckIk+rS6nFvKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927339, "uuid": "9b38f9cd-a2b9-4acd-8a8a-6477049e217c", "value": 84568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927339, "uuid": "38a27360-03f6-45c9-a557-a37f4f3964bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927339, "uuid": "40769dee-b4be-4eef-9e88-c55025f561f0", "value": "shadow.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c74ed68-da3a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765860464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765860464, "uuid": "6db75bc9-2d24-49f3-91f0-2ab83d297a1d", "comment": "Malware payload (Mirai)", "value": "e80692924d3289e198a3a0439aa49d47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765860464, "uuid": "824ffb9b-723b-44b4-8e64-41207bafc3f1", "comment": "Malware payload (Mirai)", "value": "8d673568ad17c7fedba6c16d4a114db83f82e1703ac7e8ecc0f10150d42c5393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765860464, "uuid": "948805ee-8c2e-40c5-9eb8-2da6342578d7", "comment": "Malware payload (Mirai)", "value": "08c55411a9893bd540fcc6c24d95dacf4c3d503c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765860464, "uuid": "522fdb8f-3894-4145-ac9c-280ad32bef45", "comment": "Malware payload (Mirai)", "value": "5892c80444f35b75b9d7a004866861850b845ebb07b09acd239b429c84b30f22849e10eb28bcc5d7cf85e150242f14d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765860464, "uuid": "58cdf7d2-9141-4a19-9ae3-e26ef34f4229", "value": "T1E653731ABF650EFBEC2BCD3705A51B4A349C640A12E93B367934C818BA5B60F45E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765860464, "uuid": "9f50880f-5302-47d4-8912-c7f93da3c3ac", "value": "1536:jpdQ8xKiz+jxlmPDnUANLtsHrX1KlVZAD1cVr:jn3Ki6jf0zU6lV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765860464, "uuid": "29c6a643-eff4-435f-95fb-3b5415d292c7", "value": 64396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765860464, "uuid": "6669ee02-5368-4514-bb17-8f552f84c61e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765860464, "uuid": "900c9710-2b4b-4831-9bef-72a59ea43c37", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd08bf4-dab1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765911762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911762, "uuid": "362f6100-1b52-4661-bb00-d561174132dd", "comment": "Malware payload", "value": "93d0feabda8a53b865808c8ebaac76c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911762, "uuid": "f2a07201-af6f-44da-ac1a-b19d2e0ad274", "comment": "Malware payload", "value": "8d6eae2189bbb8507b701343e61b3bdb710bd4e2f420b48a78c82e8a8a912217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911762, "uuid": "36d375a1-3acf-4775-84f0-40fc5887509f", "comment": "Malware payload", "value": "2b60a8d17f46eaac75b60b697dda50855bfe0e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911762, "uuid": "dff685c5-d87c-42cc-87fa-0bac95a57a91", "comment": "Malware payload", "value": "440546af22e5c5abfa4f4cbbc00ee02356b79ba6792e4bd86bef483811f7a1c7bf4038aa0a19bfb429aea811401dbddf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911762, "uuid": "910473e3-9f79-43bf-8047-3610544b17db", "value": "T184B3A30E9E219F6DF2EC53B587BB4F299DB517E32AE0C581D26CE9105D70318A02FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911762, "uuid": "7f466a6d-fa93-4b60-86aa-53a5ca8c5107", "value": "3072:lBXewLGQA46V6BrK81unFd13ulMWyjXdEVSN2sqBtNWpWWIEWOOiov5ShVbuKdYG:lBewLuDvR1+arl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765911762, "uuid": "f16ca0be-ede3-4a42-bccf-447fb2e1c316", "value": 118032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765911762, "uuid": "ad3e6ab7-faa5-48d5-9bcd-a16af6b8bb38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911762, "uuid": "40343a25-f82f-4254-ba0c-6bb0e47307d4", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62d597e-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916422, "uuid": "ac683b06-5b3a-4e8e-b71f-134fd5f76360", "comment": "Malware payload (Mirai)", "value": "c48305ba5d24013cd867127d9f3fd791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916422, "uuid": "abea0d15-5361-48dd-93ef-31feed443ec9", "comment": "Malware payload (Mirai)", "value": "8e40e40a596baaa7a901898832a4508f9b0f7ca527ce42fabd80ce01cf8452de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916422, "uuid": "e760d47a-8b3c-4267-bf2c-13fbbf0692e3", "comment": "Malware payload (Mirai)", "value": "849671f1a5e52b45ea29eaa573651b88e7ac5bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916422, "uuid": "6a81d3ef-6242-49fa-baa5-6be0b8c89f69", "comment": "Malware payload (Mirai)", "value": "eda42700cc335d9457c36a1cf48dc87a227322761beb60a6dc089c00a4afe0ef172ec44d9155e255146a35999255076c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916422, "uuid": "d195d7f5-e1d5-47a6-9a86-0d16b60409f8", "value": "T172733A03A98599FDC088E07943BF7276C556B07D233AB1D777C8BF1A2805EA01F1E46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916422, "uuid": "38a9b7ee-0622-4d45-bf02-bc260ae84ab6", "value": "1536:LqO1qNU3qK2iAQDEI3QSzuTg2UOXS4Tou6Z6ojiQjjw:LBqG6K23QDEIgcdOXZTouUqQjjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916422, "uuid": "ca298021-2ffd-4ac4-a53f-5664ef3000f0", "value": 73632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916422, "uuid": "05728c81-7529-4988-9809-ec3687f2863f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916422, "uuid": "a285761d-9f16-4891-af18-3154983696ff", "value": "Fantazy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e3825a-dad6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927340, "uuid": "9b618085-e179-4122-8faf-04ff047e61c9", "comment": "Malware payload (Mirai)", "value": "e424b92aaa60eea6235453b08726ba0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927340, "uuid": "14b67b3e-8b70-4559-bc0f-facb06cefd23", "comment": "Malware payload (Mirai)", "value": "8ea26d75fc703049e4e20606b7d132b3be8716587878f999cb077cc415553ada", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927340, "uuid": "4b0ea171-8967-41d9-be08-f2b400bd2e43", "comment": "Malware payload (Mirai)", "value": "35d70d40a7221489a0ebf62ac43b0a216359a0ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927340, "uuid": "63298339-d16d-40dc-87aa-34e5c683eb09", "comment": "Malware payload (Mirai)", "value": "da1c7b9f2b88f44e5b4f2e31f7619ce81138acbe892af049c857b92fc8e6f3940a03c20586c71d9078745473b81ce23a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927340, "uuid": "3ec393d6-fe56-4aa5-afa2-c9f62376849a", "value": "T18BE3F649AD408B11C9D723BBFF5F118C339207A8E3FEB1169D146B65738A61B0E3A947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927340, "uuid": "c813b215-f021-4e27-a63a-7761864b2c6f", "value": "3072:vuoaprYTtVXzHe5aq0xbkunS++RTeTFyKfsquvZtVnnX5:vufprgVXzYy9k6S++RTexyKftuvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927340, "uuid": "7e9a1636-0d3d-4e20-8d9d-2ff9caa14abc", "value": 144988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927340, "uuid": "1d450063-fea8-493b-b654-e5e20b67d6dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927340, "uuid": "4fc49487-202e-405e-8fc0-bb6e290bb61e", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a71c014-da75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765885666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885666, "uuid": "2fc56f23-8fe5-4118-ac95-9c8221c21b5d", "comment": "Malware payload (Mirai)", "value": "09a25a8156cadeba3b02fdca61f75b8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885666, "uuid": "3a708c5e-ba48-4e69-be70-189b20dfa786", "comment": "Malware payload (Mirai)", "value": "8ee84ceef944d640a4484babc0c41ff2bd6d4a5e63e11582c2b459c834dd0ae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885666, "uuid": "56fca751-ba4d-4d13-8396-4b0d46642b82", "comment": "Malware payload (Mirai)", "value": "e4d6b652d2ab6a18c1eb804debd2dbf93a6c4d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885666, "uuid": "ea21fc97-8741-4c2d-a0da-81cf4f8f27ae", "comment": "Malware payload (Mirai)", "value": "05ea79d3ba531cda9441131cd26796980b207b035cd332ce9ef500c81aa02fbabe3017c05733d386c457fc67a41450b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885666, "uuid": "9c28881b-6e37-468d-96b4-5ba99eb5e53f", "value": "T117C3F755BE419B50E9D3A3BAFF4F519C33130BD8E3EAB2179C106B65778A0170E3A846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885666, "uuid": "c1fd1550-1912-4b91-912d-46d4c653277a", "value": "3072:218aYsF17PTh9OhqakQvGekbTSszkDdqifpWHE/Vnr5:218nsF17PThG6QuVbTSszEdqif8Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885666, "uuid": "b48e8ae4-dada-4a02-b085-651952dd1ec8", "value": 121152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885666, "uuid": "9547d9f6-236b-406c-8209-6fbb542c7fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885666, "uuid": "ad1017a8-f41d-48ce-8441-a4814852f7b5", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db2480d-da98-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765900865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900865, "uuid": "baa61fbe-d551-4034-ba80-5658c777645a", "comment": "Malware payload", "value": "7e8d69ebefd9c364bac61cbdb3f24a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900865, "uuid": "f332615e-10f5-4c77-8370-f59fb37430ee", "comment": "Malware payload", "value": "8ef38082d8c8bd8ba4741b0033f02c2188ea7de5d053a45a7f0ea306100714e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900865, "uuid": "0a5f9866-a9de-4c80-8dcd-1020c01d0bfc", "comment": "Malware payload", "value": "192e59958fc15170784c03c40110788e11b41375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900865, "uuid": "bd539468-f308-4863-826f-c3f05a8662c7", "comment": "Malware payload", "value": "318965d9f7090a493d6c717b93fcc868d4b9d1a781b020ad0609575b50b85c655a4dd7b61f9eef41ffc696e195b3dbff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900865, "uuid": "8fa67189-a324-4639-bd0d-3ebd40f01e93", "value": "T133751846EA6404D4DCB687B59432D83AA9733CA95B74EACF02E57D137BB33D14839B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900865, "uuid": "0337c339-48cc-4b08-89e2-99423b7a7698", "value": "63da3ecbb96f94ac4609da3efedff6c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900865, "uuid": "c0ed4af0-d816-4774-807d-eb0cdf0d182a", "value": "6144:y1knrVBnWXmybCTd+UjBdLwi+qpGI8JIo+/zz7YP7O4bPSpYHY2bUZp0uNrxfbGk:yWnrVBXyOd+UtdLwi+fDeo/TUlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765900865, "uuid": "ac45b9c7-ddc5-4d23-ab94-ba4a9dfae112", "value": 1655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765900865, "uuid": "5d38e667-3f95-4761-a7fe-097158eafc21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900865, "uuid": "40a562e4-3f6d-4be0-aec4-bcc4393cf5e1", "value": "invoice201025_DocumentReader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc7b12a-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879444, "uuid": "f4171e68-dfdd-43b4-9db1-3665cabf1af5", "comment": "Malware payload (Rhadamanthys)", "value": "901c1d0d8043d6a3203ca652fe38a7cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879444, "uuid": "f06ac867-e457-4b19-9b5f-e5c264ab06bc", "comment": "Malware payload (Rhadamanthys)", "value": "8efb02a5f8d79f51077695211204d19448828b3f6965df28f761f753710274b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879444, "uuid": "f1c99d98-ab1f-4ab2-a89e-1c94127512c2", "comment": "Malware payload (Rhadamanthys)", "value": "4e80ee42455cd6818a972ee1bbaca50394283d2c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879444, "uuid": "fb245a1f-b446-4011-80d5-9c8d3c43f6cd", "comment": "Malware payload (Rhadamanthys)", "value": "1e2e88bd7652a3e5f154c372d17fc4b6643a720ce8b4494be49d571d82ca83cf5c0bf9b3ebf6b3029cd8ce27877f6985", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879444, "uuid": "95dfcdcc-4488-4c3f-8ed3-f3ccec6d8569", "value": "T194A31863CD148CE50E4A6D9D99AF0A75CD390902596622C49CEF379AE4F1FE43DE8283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879444, "uuid": "55ce3602-f46a-400f-80fc-e7147565797a", "value": "1536:GDB7eKg20Lf3Cr7rqfQ7IhqZ4lAITyTbe6BkQWJ+aY:GDB7b0kHcNqbe6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879444, "uuid": "e1bff754-3295-4bc3-bc9e-38319714646b", "value": 98137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879444, "uuid": "a36280b7-5b32-4c2f-9f0b-82e6a6dc4df3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879444, "uuid": "792895e7-00bb-4c84-b1c8-daea93f57874", "value": "invoice-1637482117.pdf (94).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf58aa7-da62-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765877915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877915, "uuid": "06cec0bd-613b-4139-88c4-76d3f7cc1cb3", "comment": "Malware payload", "value": "5dabc190ea0b38d29ba597a0233bc730", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877915, "uuid": "46e4ac55-666c-4508-bad4-afb9eafaad91", "comment": "Malware payload", "value": "8f39a72ce285c542a5c071abd8250fb7d8ebe5cd07c484e03e683352d3a1e200", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877915, "uuid": "1475eb27-0b94-4404-a5b4-d013e7de8620", "comment": "Malware payload", "value": "7f74ae4157eb3b91eb08ee3e6b88f688e8517c37", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877915, "uuid": "896b9acb-6b17-4a12-a9bd-ae4bdfa0e995", "comment": "Malware payload", "value": "fe463a2d800d60d39dd932ef120b5ebbb261a2c71e657c245621d63cb251026e02679c48bc709697433244dc3f96643c", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877915, "uuid": "8b23e7f6-6ce3-4086-9e08-725fbd9a905e", "value": "T12E645290A2C07885634F3A7E3F4FB0D5EC9E8DEE3554194BD25A7D5060BA70BE4E1A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877915, "uuid": "22816b57-f85e-4c6d-9c03-ad1c8f69e182", "value": "6144:EVMSYadksDvM9hYmh0zJ3/qDnWkdrvaOVDCodNErUHo:EOadlU9hYmh0zJ3/qDnWkdrva8dqryo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765877915, "uuid": "a5b0f7c1-5146-4201-9725-9ede9e6eff5c", "value": 318846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765877915, "uuid": "b61b6d92-e0c1-45ea-9bc6-3d7081f124b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877915, "uuid": "7c1e38b6-a305-4659-8995-f7364eb73cc4", "value": "VESSEL PARTICULARS.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4909122-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879590, "uuid": "3e110cc8-b909-4e06-b793-653a532a0b7a", "comment": "Malware payload (Rhadamanthys)", "value": "0d5ebef0a9bf17fe9a827701dbbdf8d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879590, "uuid": "4fe1cd24-5f21-4ec1-b472-708675fd32f8", "comment": "Malware payload (Rhadamanthys)", "value": "8f48a434ee5f148c436ba55d193e4e4b3077e50166d2708a4305dabe4cb66e2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879590, "uuid": "77f94ed2-42d4-488b-91ba-360dd7566891", "comment": "Malware payload (Rhadamanthys)", "value": "66f76a80ca47b2e8ea4e8d394800ee5f81920c0e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879590, "uuid": "752a9f89-10f8-4075-a411-0fda88e5cec5", "comment": "Malware payload (Rhadamanthys)", "value": "2c0d56f73249f8dca19134f1b8fe37dfba06e50b81b73ba4586f119079548da12c34c5ebe55780028cd7d43a5ed021b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879590, "uuid": "995a46ef-dd88-4aec-a6b5-9fe8efa69038", "value": "T17493DA4BBB51BFAD51491494BDE4A4F8972A7D1F810FB3CA48AEF350919DB8B30090DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879590, "uuid": "7c19fc16-f563-4cd8-9fbb-a8bd02ce8a8c", "value": "1536:GDB7eKg20feXr/r64XRAUb2ZFXA/AXWkhx6BkQWJ+aY:GDB7b0fe7TLXuUSZF2AXWk36BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879590, "uuid": "8425c7e4-0d0a-4297-a389-f35a6f2af173", "value": 95375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879590, "uuid": "ce56d4bc-61f1-4c18-abb8-7daba24b6e63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879590, "uuid": "f8b54648-e838-4417-b24b-663d1bef78c1", "value": "invoice-1637482117.pdf (72).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acec024-dad7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927758, "uuid": "5bc1039d-fa14-4919-a82a-bc0bbf448bcf", "comment": "Malware payload (Mirai)", "value": "e2e9020f86dc37f409be7b8ca9081e56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927758, "uuid": "938343db-dfd7-4fea-b4d6-4079d899d189", "comment": "Malware payload (Mirai)", "value": "8faa9c4e07b0bcb159683e21ba05b0d2b81ff6b074e701d362d676c14911204a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927758, "uuid": "16456b88-9832-482a-a6d3-6905e7ad642d", "comment": "Malware payload (Mirai)", "value": "979d6637057fb080c8b9b24d55e94d91a2c017b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927758, "uuid": "b8c23361-4db2-427e-8f99-1a1bbb2a751e", "comment": "Malware payload (Mirai)", "value": "5ad0454153f4b97ee8d7ccfbd5f2f5660e4b60dfd206fe7e29c3264f7e06b5a9ee696b49696406e598505c968ad2a24e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927758, "uuid": "75b4049d-5f58-494f-b4be-f8565a399c66", "value": "T14EA37C62801E8DB4E2D88AB568E02D3CD322594336976EBFD5B4C5D0048BD9BF68F375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927758, "uuid": "21723419-e0fa-4e23-9ade-361408df3270", "value": "1536:7QSJGQbp25Apq6VmK/Su4KVZ7HPWUEdgSQCsVdBWCgYVRBVf:7QQNIV6VmK/Su4KVJEdgSQNnACgWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927758, "uuid": "72b4b70d-ac76-4af7-9413-1ca71e783c65", "value": 105908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927758, "uuid": "a76c1ae3-6588-4e38-95ee-42fbb33da1fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927758, "uuid": "420e6765-7959-4986-9ed1-c6c83bae3896", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82e24f4-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879516, "uuid": "adeaaab2-1b49-479d-ba5d-2da2c346b3d3", "comment": "Malware payload (Rhadamanthys)", "value": "0b4462b05de32b8b139db4878907ac7f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879516, "uuid": "2c39a213-2bef-4232-a329-744b841bbc62", "comment": "Malware payload (Rhadamanthys)", "value": "8fec23ffae7768cbefe5ae45178dc6a3e6c012584474bda268d4f44127c3ff26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879516, "uuid": "0925eff4-1df2-43dc-b3f7-c478cddb308d", "comment": "Malware payload (Rhadamanthys)", "value": "c5594a363cd8755322b1f548b1b8f6bcf3009b64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879516, "uuid": "c75911c8-6af3-43fc-8f77-f4305b44d862", "comment": "Malware payload (Rhadamanthys)", "value": "0f182c5c96daefbbe38650088f0e5483f5b857fca5f9a3eb6ca1b07ab5c8f0059ca0375e09ee146339ba80f33d63f1e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879516, "uuid": "db583189-bc6d-4115-8cd2-ea9a61f5a657", "value": "T1E5A3FA11DC72ECD572D154303B5BACA69CBBE4CACD70A347A9277AE3A61C3180E21D97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879516, "uuid": "d64e0563-ee9d-43d9-a7ec-93bab6da93df", "value": "768:GDhd0i7J4sYKgY/CMNfWdoSibhL//v93pUn1Db7pP8VwyBCy+T/xhHirXuz0MKLw:GDB7eKg20mrLrWcNswAs0+6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879516, "uuid": "5802c763-79bb-4b98-aad9-93ef30aa1a02", "value": 101411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879516, "uuid": "d3e4308d-d155-4179-bf0c-7bcb1266e514", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879516, "uuid": "e61b4b29-7c1d-463e-a922-96b66375d198", "value": "invoice-1637482117.pdf (84).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381ff9b0-da53-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765871140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871140, "uuid": "2d754d54-a545-4a8d-8b57-122c919f8597", "comment": "Malware payload", "value": "0c9ac7c2ac40bc4041d1eae3346e1c28", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871140, "uuid": "93aa18ba-2ce2-424f-8e95-94c9343b86a1", "comment": "Malware payload", "value": "904e4153d2026380dc42297173192e72de7e5d9ea50f16bf8df2e2fa6922cdc3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871140, "uuid": "90e40fdb-1da8-4070-be88-dc93f434f7c8", "comment": "Malware payload", "value": "fac047c261176de10cbe39e57ce2b1a283ab9e04", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871140, "uuid": "0098fc75-97ec-4366-b355-6483f4edd073", "comment": "Malware payload", "value": "951e46a736bb7ca48b5104622129e71ce9f05ad0077c7e1fbb5fa6cc65f6ba151b8162f063cd57543724bff7fcc7780a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871140, "uuid": "326a6add-2f1d-4c8b-8aee-9b358cd67e2b", "value": "T134761203F78E4D2EDDE2BA7C5D53537166156CEC1820928B0902F218BEB36E96F25BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871140, "uuid": "9fd768cc-798c-4b7d-b4ce-4be23f6b025a", "value": "98304:9lWAbCLnAK+4OZ7awKvIPNZ9nPI9cCDrN4PHjv6Y5yNCEq3l/Z6924fM+U02ZweS:onAXZmhIPf+baDN5y6z692PEex8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765871140, "uuid": "8c3b202c-c28c-45a9-9d08-568a0a95b044", "value": 7369993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765871140, "uuid": "25c2999d-5586-4ffa-bff1-47fa2f7b549a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871140, "uuid": "1d431aa3-e06f-47a2-b1f2-267bfaa9a3db", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b01b32f-da6c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765881802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881802, "uuid": "4d4047f9-18c5-4a97-ab9f-49dabed23768", "comment": "Malware payload", "value": "3677b5f77385c28e7d342fa59d8da28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881802, "uuid": "8e2431d5-81b4-4d51-ae45-4124787e9a1b", "comment": "Malware payload", "value": "907f18fc619a027a1d40b9f21d91b2b0029f1e893065c99f1d5563cd7f14dd37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881802, "uuid": "e496f5cb-98cd-4b7f-920c-dcf820fc442e", "comment": "Malware payload", "value": "9086e74f101b9286efe540a3b1b07f7fe36f2ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881802, "uuid": "35cdeb5a-d759-4e85-8738-e7cee2da417d", "comment": "Malware payload", "value": "669c22abc956e03c3792461c41feed35e1d787aca6d5a79b168323c137cb99a8ce7efcce2d621fa478d3d93fa9ff3d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881802, "uuid": "8fa1c358-021c-47a1-935e-58b8d0a58904", "value": "T19F36D072A5118895E02805F291B30BE4297C6EA1D878655FFAC4FCBD3CB75328EB56CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881802, "uuid": "513cd22b-e89e-4d1f-abc2-eb5c9842ca66", "value": "9165ea3e914e03bda3346f13edbd6ccd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881802, "uuid": "dda83d1e-2f2d-4715-a291-699c644e03e7", "value": "98304:DGVFpYv943KqHDR7oY1Upw3DkHrzihJG5aWxLm:iVFpYl43K+DO9w3M8J0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881802, "uuid": "a47e807e-95c5-4b05-a0f3-41485adc375b", "value": 5218858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881802, "uuid": "d60fe877-5898-46a4-820a-f3fb1c9c2272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881802, "uuid": "719c9352-0c54-4429-975a-2de8b3eac82c", "value": "47.98.224.91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1782a8f3-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926920, "uuid": "f0dbf49c-6b82-4356-80b6-576e19d0ee6d", "comment": "Malware payload (Mirai)", "value": "48a75118e2a9ae193121edc70eafca63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926920, "uuid": "c2d4237c-e760-4825-9c49-be68f01a083a", "comment": "Malware payload (Mirai)", "value": "90bcabf3348f1e70612c97b62676df744d93c3c0578121710d953f684f308152", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926920, "uuid": "8f3e9bcc-721f-4200-ac04-54229957c7f9", "comment": "Malware payload (Mirai)", "value": "5f1ffe6649698f0dd5e3ddb2e35f65828182be6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926920, "uuid": "fbc2d31e-d904-4f76-bc72-5455f93a03b8", "comment": "Malware payload (Mirai)", "value": "9d1e605861a4fd92d20b07054265bcae8bcb3bbcd827eee0047c61e9519cec1a129d5f9fb9ff0ce8aa90ba97d2ed59e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926920, "uuid": "08bfb328-3d4c-43e6-a2ca-cd532e015bde", "value": "T156C3F846AC518B66C9D323BBFE5E12CC331203A9E3DEB51B9C146B5C778A1270D3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926920, "uuid": "4c803007-e261-48a1-850c-30b081cdb7bf", "value": "3072:5gV7jNdddMSNItjWHnGaWUN5NhVnoz5FE:5gtNdddFmt6HnBWcDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926920, "uuid": "9689f06e-d085-49bb-9172-18bd9c3d4539", "value": 124820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926920, "uuid": "80f7373e-122c-4ecb-a7b6-3a32f1878dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926920, "uuid": "cba26dbd-1d1c-4c79-a79a-0400c3608747", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a7cf72-da7d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765889499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889499, "uuid": "ed3fa263-e681-48c4-8459-234aaf67b324", "comment": "Malware payload", "value": "aa12cbeff2f747b8d96e134c5cd92465", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889499, "uuid": "f5c460a9-3b25-476f-8f9d-3d771f6c6f27", "comment": "Malware payload", "value": "90bd2edb6d0f717d57bcee9538d49040ebf7e2dba57eb83762d9a02e6d085712", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889499, "uuid": "da386926-c67b-428f-a497-5234512e319a", "comment": "Malware payload", "value": "de00efab1a125fe3d112970cd29edd114c988df2", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889499, "uuid": "a61fb7ab-c2bb-43c3-a093-2e83a2a56367", "comment": "Malware payload", "value": "59a9c66c31ff7fc0c78edb17c0db4f3b92fe69bf0a79be782dad1b0b1b6c64611436001275c399bc54738775d90b1b74", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889499, "uuid": "9a5a6a83-9491-4ecd-9257-4596e9a80eb5", "value": "T1CE130299761D0C9AD17E69F720016D1118B6B1B3BFEB0CB81258B4463624DC6FF96C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889499, "uuid": "398b8591-49d3-4969-a7b3-09a35322a76b", "value": "768:YbArxb20SkXr2jzvZdHqvdbmYLHlnq2gM25UUgFdeWx7EBR1xDsc942HyCPSdd:YbuqnXSbmYjlnW9Cnem7UR7u2HyCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889499, "uuid": "936b00b7-e659-4775-9a0a-6e5022172238", "value": 43974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889499, "uuid": "36767f6d-ada9-4860-b7d1-54109f551850", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889499, "uuid": "e23938c1-f1f8-4055-8ca4-5d139b6efa26", "value": "5505508e528b4e79a7424a861a33be6270311c834659e7f18b806220a1bf754d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239258be-daac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765909331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909331, "uuid": "6cd932a5-81df-40b1-86d2-724612e7d6b3", "comment": "Malware payload (Mirai)", "value": "c3e59ceece186f702b62a42597e98a98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909331, "uuid": "1ebbe38c-2a85-448e-9263-e14ba99d3e1d", "comment": "Malware payload (Mirai)", "value": "91026f32f2fd4e66fb1a49260a4d6589e7ad1496f166b5f1d75da71e3c2f705a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909331, "uuid": "abf42867-93b9-4418-92ea-8f780ffac5af", "comment": "Malware payload (Mirai)", "value": "baca69b9a5ce325a640ce235f0b53fcae8a75bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909331, "uuid": "e6e09b85-476d-4e0e-97c9-8e388a071e50", "comment": "Malware payload (Mirai)", "value": "85987be41ae8e755c95c865053d1afa5dbef93329437a86818bfa3fe460b1a1fc93e941219166a363e8d22a1d51e3623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909331, "uuid": "c1f5f7b2-801a-4c41-9edd-c7f5909dbf51", "value": "T127D30865AC408B25C9D763BBFE8F618D331313A8E3EA7026EC141B5577DB11B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909331, "uuid": "ae472be0-4dfd-4f73-a4eb-4f5b2dce2cae", "value": "3072:b3AOdKbLPmp37PID55jDP3fuOIqT9kGki+b5gcVnp5:b3rdKvPmp3O5JDffuOIqTCGki65N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765909331, "uuid": "3b36c811-a2ad-4985-8ab9-ac9b77ce9463", "value": 141008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765909331, "uuid": "c7f95058-0793-4bd2-a669-d9d9c7a39a65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909331, "uuid": "5caac2fd-c0f2-4bff-a332-16acc32fd415", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa7834b-da53-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765871153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871153, "uuid": "5d56d28d-f2a9-46ad-994c-96e8de5425aa", "comment": "Malware payload", "value": "6111f4d6f77b93eb2591a834560f1c97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871153, "uuid": "097586e5-6c88-4ec7-83ff-216a17d8f336", "comment": "Malware payload", "value": "91d00ca46d1013c031aa8ff2e54b7b3496bac78f6147842766bffd4d32a2e042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871153, "uuid": "e4c7325f-5de3-4756-b7d4-646f876c6c17", "comment": "Malware payload", "value": "30a1ca6af8da41d927efd3d0745f573cd4c79dd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871153, "uuid": "8a27e318-66eb-4be2-8505-2e26ec92275f", "comment": "Malware payload", "value": "2a1341f18e8248374eec724c3116588d3ddf7a61c2e2c2500ed79bd54dd91edb615b112e47e69503059fe0a8a7a13af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871153, "uuid": "1318e1c6-2334-483d-89a4-a203487d69f9", "value": "T1A255A44BFBB610D1F5BAC139A552322AFC7234A1873897D792859A0E4B30FE4AD3D750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871153, "uuid": "d04e5d88-c94f-4d42-89fb-fcca0880ccf4", "value": "07ff713f44efc74a095a4c6db657694d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871153, "uuid": "a146b860-e7e6-46ca-bbd4-ef4583585f73", "value": "12288:6qfKNnex5Zxrc79wWiCp6x4yK2IMwFFjca8jo8luAeRZMRQ1vej6qXjJqxcPRO0/:6IKNnex5Zxrc79wWiCp6x4dPxcPRKMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765871153, "uuid": "5f113087-8e49-447b-b82b-c43545997379", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765871153, "uuid": "b5765600-3252-477e-8bab-b1c638d7466d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871153, "uuid": "1823d2da-bd15-46cd-83c3-5f23e86e2293", "value": "prcc1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe5abc6-da3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765862805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862805, "uuid": "354fd0ed-a46d-4276-8a94-b3744414574c", "comment": "Malware payload (Mirai)", "value": "509fe9e189dad5674f5c51cf622ab8a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862805, "uuid": "a85c6531-ff14-4853-be5f-628dfc98ef89", "comment": "Malware payload (Mirai)", "value": "9233a96f6cc89f7414df90f601583f72a21b1f9eadead4e92ca220ad9cbb3529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862805, "uuid": "b71cbe89-9d84-4318-a9fa-66e97e3b6a0f", "comment": "Malware payload (Mirai)", "value": "f9c3e4c2e53f5243ac1507cc2ced1ff7a33c6f8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862805, "uuid": "a4695deb-5ead-4b16-8ce0-cd32bd1c8675", "comment": "Malware payload (Mirai)", "value": "bfae90b8585eb18e1fa613698d02eb6d7d7104321f69775b7fc1c235b193e29a959c04ffc20481e9b7ddcac42d77724a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862805, "uuid": "2fa9b174-626f-4d25-95e8-b993e614e7ff", "value": "T10BD30845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862805, "uuid": "7e14007a-1c21-42bc-8353-ebc72239e723", "value": "1536:3HCesIjTbgff1AcBs/GPFfAOgGj4V7Cs1qT+PpG8PjdKGTUWFIlN8VwywAF5IYO8:3HCJYcaEFfiK4wLaPpG8jwWFDTjib8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765862805, "uuid": "a94e11df-2383-4e0d-8fca-142b4677bb21", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765862805, "uuid": "aa3db67e-ee30-42b7-9ab9-f8d89da8c05c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862805, "uuid": "95ec36ae-e4a1-48d1-80c3-3a104ace253f", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0045b3f0-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895957, "uuid": "7a031116-f27e-4c8f-8b8f-a3c3f87b2bb2", "comment": "Malware payload", "value": "258fd0f977f784756b1692a3b3984d5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895957, "uuid": "49188c3d-ec53-47b9-97cc-3586a6735e4c", "comment": "Malware payload", "value": "92831a1787d7aa5409ad6029c085c86352a49f6305df297c06841af56afbdaec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895957, "uuid": "1424dd88-05fc-4c6c-b1cb-2eceb3a4c7ae", "comment": "Malware payload", "value": "2980c8813b603becc356596860419d93e44d4e8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895957, "uuid": "46fecf5d-7974-452c-b497-9f52983d7f67", "comment": "Malware payload", "value": "0a5bb62de70b1a968826addad3e7d68966032370f74ef28b644f5ba232d819240d728747bde99b5767ed806eb4f985f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895957, "uuid": "bfca95db-012a-40dd-9edc-a87f2d0c006a", "value": "T1015533220A01B996ED1FD2B40D82FD3224971F7BF7C7465BD8E43C8F5A91815A326B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895957, "uuid": "58c1cedf-e8a9-4222-992e-106313e8d055", "value": "5d6371d3e0856f42845cb819126ee094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895957, "uuid": "02932716-c8d6-4cb0-b099-789fb5c50480", "value": "24576:4KuqAwqWy5/eH5/jbj2QFEv+nctssqxILcqzdmyzTqIRlOsaFMa:4KuCjNHjXBcYxIcWqG0sgMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895957, "uuid": "5a2a508c-66a6-4fc6-bf0e-070776b638c8", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895957, "uuid": "32fcc761-8229-4222-ab6f-e587db41004b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895957, "uuid": "7e16c9e4-d492-42f8-a9a3-943828f8890b", "value": "X2JXjTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1856536-da6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765881249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881249, "uuid": "ced29df0-ba2d-4ca4-81c4-34ed5b71cee7", "comment": "Malware payload (Mirai)", "value": "93b83b77ea118866ac8c7dfc45b79593", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881249, "uuid": "a8621aba-66fc-41bb-b393-33f9c571e33d", "comment": "Malware payload (Mirai)", "value": "9299968239503ca4bfcd8bf425eb15828d991acd7f0de2aa4b528b9e9eaf3284", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881249, "uuid": "9c81a3b7-6c0f-40d0-864e-cb44f60ddb93", "comment": "Malware payload (Mirai)", "value": "7a191d063b4e27da8f1f1f48c3d3ba90f5aba7e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881249, "uuid": "de6337d2-6870-44bf-ba26-bbc1f1197870", "comment": "Malware payload (Mirai)", "value": "ece36f25285bebdcedf3fc8ce95dd27817ab45685659d515da481b61649a39bd1e381b6e7bfb44230578b10b1193c8d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881249, "uuid": "f8cb2c41-25a4-4b24-b859-8cde60d37590", "value": "T1C743A612F4C1921BC9D4E6F6F75E11AE331563BCC2DB3247E8244B21368998F0EA7E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881249, "uuid": "318dd3aa-9316-43d0-9de2-6b0dfe7de6d3", "value": "768:3qe/6ZSOULzroNbYECMu5JSBhENshOu2uHOgUWBo3P6PNRK7rIP:U6roNbYEY54LENsQSHObW2PUGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881249, "uuid": "86926bb6-e49d-418b-a372-56f5f94dbdb6", "value": 58612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881249, "uuid": "7d51fefb-939e-4274-82f5-54dfe4d9a990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881249, "uuid": "53c349f5-2968-4c82-b909-62148af1dd4f", "value": "shadow.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e7f800-dad9-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1765928877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928877, "uuid": "3f8388a8-c029-4e21-8d57-a2de6c6bb5f5", "comment": "Malware payload (NetSupport)", "value": "d0d1993f76a70f8951b7e0e07ab4d436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928877, "uuid": "6f34d622-f3e3-4570-af90-4aeb742d3a3c", "comment": "Malware payload (NetSupport)", "value": "92adacc21c4ee21ff59eb91ea44b489c0f03e417ccc05a455c09a9d2d65963a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928877, "uuid": "3bcef006-c642-403e-bc40-6f98b1a5a76e", "comment": "Malware payload (NetSupport)", "value": "3276d3a9d02ecf712a0414cf101ac3958091b534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928877, "uuid": "854a0809-bb14-4ef9-849a-5bf351ce4d59", "comment": "Malware payload (NetSupport)", "value": "ac85b42de5c35903e4500d4821517d1d7eccc9bd0cd75d6a4366256c94b3d72322603bce7d6a8f66faeb9bfa45456f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928877, "uuid": "bca07917-2075-4c23-a8cc-3fd54985a0ef", "value": "T14396336BB2AC03EEF9A59238B9718471C269BF170B15C597B2E4CD6E1D231CC16363D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928877, "uuid": "b6082e56-36ad-43a9-a499-bc56465bbe85", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928877, "uuid": "20cff6ec-74bf-403c-b195-cfb6ce616243", "value": "196608:DCugl7c9YbonurHmoFP/XRL94GG2NTsj+lOnO:DCuJqknuCAXH4GZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765928877, "uuid": "1a507ee8-b3a1-4584-aad9-610bf8295aa1", "value": 8778901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765928877, "uuid": "dee01fa6-d4e1-47cf-9229-af252b6f8459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928877, "uuid": "343cc05e-c7eb-4009-a1ea-ef5ec51de9db", "value": "agentagent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45891690-daae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910247, "uuid": "67fe563f-0b00-42c5-b8f8-74796d30b811", "comment": "Malware payload (Mirai)", "value": "01a44dd7132c3ec3a690eb1f911c5f16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910247, "uuid": "bf2e6524-c061-4bb4-b43b-52089f435420", "comment": "Malware payload (Mirai)", "value": "92ca167de849a96490fa11970514c8f2414d0b84adc3317e9035e40b2286162b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910247, "uuid": "035d7b1f-939b-4982-98ba-b62ded022658", "comment": "Malware payload (Mirai)", "value": "f39955a003503383e73b1031ef102018eba7798e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910247, "uuid": "21ddea3a-063e-40a6-9a14-920730541dda", "comment": "Malware payload (Mirai)", "value": "ddba01462f4c41aa61f858dc3caf03127ea1a0c30624ca2638c50c18963525dd003a2e3657daaf48bbde05fb5ce2c949", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910247, "uuid": "3d2811eb-5e3a-4a8c-9857-e1061d0d0023", "value": "T1C9933A325865CEF4E26849B7B0D0473CC327169226872EFD54B6C09D4587E9BFE0A3A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910247, "uuid": "22fb243a-ebeb-4d69-9acf-1e8236435fb7", "value": "1536:tXDOSXxRRIKgytnK8zWhyAL10YHSU255+UsaQCrAkirCkIV:cUxRRIKgy5KvhD27+zaQ+/GCXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910247, "uuid": "9984fdaa-385c-4c64-b6c6-b6c0bef63821", "value": 91308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910247, "uuid": "0eea316b-e727-414b-94af-5aea2ea597bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910247, "uuid": "cea48d1c-5ee2-42ee-9d3b-29f5cfdf0826", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3573838-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765895828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895828, "uuid": "c8b9a807-0796-44da-8a81-2e17b09489ad", "comment": "Malware payload (Mirai)", "value": "c7ee3da4b0bb4a72348655f084f6c53a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895828, "uuid": "e2f41dd4-df3e-48a4-a2fb-ca9d535b5774", "comment": "Malware payload (Mirai)", "value": "932fc310d3536f5c57945f242c5c3677cac44a52729f14d7c8ebf8eb244c1e24", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895828, "uuid": "01047cd8-3119-4f24-8f7f-518a5b45313d", "comment": "Malware payload (Mirai)", "value": "123f04f0380343db3259e7c70d82f1b6170b5042", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895828, "uuid": "3ddf17a5-f453-4fd6-a5e2-ab66ec802565", "comment": "Malware payload (Mirai)", "value": "c951df8401ab32781d536e385a9dd358fb844581ee86afa30dd0a4ca59768f73931ab6710acf27e6991432bb376f1c2d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895828, "uuid": "9cf70063-404d-4dd2-b9f5-0a406444b234", "value": "T1223193EB1012101A3C015E6CD2A5FEF77103D3FBE165C9D1588F643AB0F9AAAB4E8718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895828, "uuid": "aa03f49d-a1e9-4deb-9183-8b24b5e7890d", "value": "48:WxTDMHt5LfoYyBw7SYzjFSjQF4SopDz1yNAwr:WxTDMHXLfoYyBW1sJyNAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895828, "uuid": "483a55cf-900d-44ab-a2da-237dfe8cd038", "value": 1661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895828, "uuid": "15a287ee-9d8a-4e09-9a17-21daea993322", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895828, "uuid": "1560c582-f7aa-4a7b-ae6c-79f7d65ce3ae", "value": "shadow.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e529a15e-dad0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765925118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925118, "uuid": "1feca925-cbf5-4230-8d6c-7bb547668e0e", "comment": "Malware payload (Mirai)", "value": "23309b6754f04b390836e04b21a8b1a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925118, "uuid": "6641f12b-c8f2-4bc4-8475-c1beb0e27981", "comment": "Malware payload (Mirai)", "value": "937d3b47eeb46975a7726a76f559662e5557b78bc8c91a2a03cda14b3f0dbebb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925118, "uuid": "e26fdccf-eb97-4971-ba94-0a34d79f9c96", "comment": "Malware payload (Mirai)", "value": "5b03407f7f3a1e105ec0423d29c3b00b6224cf2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925118, "uuid": "4b163de3-792d-439f-901d-f18909dec50a", "comment": "Malware payload (Mirai)", "value": "1c1ff0e1601f383849d37a2ade27cdaa8a8a208484e6a6ea7c502a73143b2a5ab8788430cee2e53f2ef895b628aa2b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765925118, "uuid": "e40a4a77-830d-4c5f-8594-ad48d044835d", "value": "T10AA3084AB940AB17C5D51B76FE4F134633678B58E3DB33029A181BB46FCBB1E0E26506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765925118, "uuid": "80aae304-a3c6-4e07-9bbd-e82c800aa81d", "value": "1536:W7n2uDzfBDG70zgqynTxKyR30ajLCSf3f0JZelPy/Aib304f7x9GsPgS+mLdg7l2:3udGIkqynHrjLCSfPOR30YNqLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765925118, "uuid": "f419d947-4096-48cc-91f6-01217bcdccaf", "value": 105267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765925118, "uuid": "82ccb840-47bb-43db-8c55-143258e600da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765925118, "uuid": "cd4a7158-b842-4259-ba09-54834014b28f", "value": "n4t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a723be4f-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879487, "uuid": "c1ac85c2-3977-4b7c-8008-f21b34d0d9dc", "comment": "Malware payload (Rhadamanthys)", "value": "eaf2af61f064b00e52a6bd7f40e4e0a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879487, "uuid": "8eeb6d4f-324e-4677-a46a-c5013480d7d5", "comment": "Malware payload (Rhadamanthys)", "value": "93a53746960750c7d654f3dc20130d897994a61d972efcaff7acffcb72414b0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879487, "uuid": "e7d44325-d87c-4fcd-ba4d-740a20bc2760", "comment": "Malware payload (Rhadamanthys)", "value": "9dbf2eef98002f96a9cdd4dcebedcbc10c854928", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879487, "uuid": "d65f86d3-6aa7-4cec-b15f-68941267ce17", "comment": "Malware payload (Rhadamanthys)", "value": "a5c64aed2eb3669d8319c91e70d92c061f98770bfd7156653fec6f4266999fa49889acb07fdde8a1fdeaafcb6387831d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879487, "uuid": "a143dcab-fc6f-4355-84bb-8f3969a78876", "value": "T1EAA31A61DC1B4CF09667941E0D9573DCC5A9AFE6C21A8B0D98CFB3A3C0C63252DC99E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879487, "uuid": "36d41c16-e695-44ca-9962-5b6e62e04426", "value": "768:GDhd0i7J4sYKgY/CMNfWdlTiN/rXEcrGOCiH0DAZ1khSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20UrrrGOCnDAZOh6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879487, "uuid": "0680a890-57f2-4bf5-afd0-b1dd5d7a3ccc", "value": 100690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879487, "uuid": "8cea66eb-bec0-4594-993d-332cee7a629e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879487, "uuid": "2fd779c4-fecc-44fd-8f35-47cdf1c5b8ae", "value": "invoice-1637482117.pdf (89).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92f9aaf-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879947, "uuid": "bcc6072b-6f76-4d8a-9014-717a4e705ba3", "comment": "Malware payload (Rhadamanthys)", "value": "f6e77aa197774d3d8dcdc55df6d6f1fa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879947, "uuid": "34efaf19-c676-4e23-abe4-2d77d8a45698", "comment": "Malware payload (Rhadamanthys)", "value": "93c86fc66811d1af5d907cac0e03bd57d75ae68f80ea1caa25b27c84bdbed0ec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879947, "uuid": "76cc1051-46ba-4d91-88ea-f8161b8da919", "comment": "Malware payload (Rhadamanthys)", "value": "33b0fc53003396fb44fc0349a939098f3f295996", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879947, "uuid": "7f023e61-d1eb-4a41-9c45-6a10e53df6f5", "comment": "Malware payload (Rhadamanthys)", "value": "11dacd7620ba735c1af89cd8af56d876c94b35f9dbba8d84113819e0c0a429712e964251839d6a51d7ee12c3c2791fb1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879947, "uuid": "d9571ddf-d5f1-44da-af3d-58fcafaf58a0", "value": "T113A33B91AEB82926260F6EB6388C40F31FE758853E5F1665D737B710BFA07040568DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879947, "uuid": "33b2caa0-46bb-47a8-a0af-81d0267c4f25", "value": "1536:GDB7eKg20i/QyrfrIENECAcwH9o6BkQWJ+aY:GDB7b0i/QQzjuqwC6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879947, "uuid": "a466afa0-e67d-4e05-9b07-44a91cad1fde", "value": 98033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879947, "uuid": "6f9f9b10-5b9b-45bb-b73f-c2e702690cb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879947, "uuid": "8d0ba68d-ed7f-4609-bf16-84f21bffc998", "value": "invoice-1637482117.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95f16ee-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883356, "uuid": "421fae81-43c8-4884-a3da-067accf8ab1b", "comment": "Malware payload (Mirai)", "value": "a4fa5d67dcf485bf6e27afc9358eaefd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883356, "uuid": "764f03fa-e769-4955-b4bb-54c76c962ae3", "comment": "Malware payload (Mirai)", "value": "94571c26064f12f7a2b7294b43e28afd7f8b8220752b1a7d7fb33fb0fcac0ca6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883356, "uuid": "d65b790f-44c7-49de-bdb0-11190112ce53", "comment": "Malware payload (Mirai)", "value": "c9df124caa7afea65fdce2b018fc7cceaa5dcbd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883356, "uuid": "6ca6b7e4-2b6d-46cd-a63d-95154bac5acc", "comment": "Malware payload (Mirai)", "value": "c7606e0fbfb86aee5195350759891332e06e8edc3f245ec87d2f591e652f55b92a6a06112e2567c6ac3e1182469be84e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883356, "uuid": "51da1803-9ed1-4276-9797-042f2d2ce051", "value": "T1C4C32944BC429A26C6D7277BFF9E039D331613D8F3DE7207E8246B547B9A0160E3A925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883356, "uuid": "71b1d369-144a-451f-a254-e6d3bd027356", "value": "1536:9PhOe2aSSwnZrgfVVazV7xO7C2zzR5R3Uusx3TG6KFgwjYZO8nX8VR15ZS:9PU1NZ7xO7CGHsx3/s7jQO8nX65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883356, "uuid": "2ad02eaf-ede8-4b73-ae37-d046d20241c8", "value": 120412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883356, "uuid": "1bf9f090-d124-4f0a-a4d9-8d493f013e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883356, "uuid": "ff2c5125-ea5b-4bc4-a6f1-b75e98e9850e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d44c224-da19-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765846292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846292, "uuid": "4cc19c71-ea8b-4428-9eb2-f4b339fd3fd7", "comment": "Malware payload (Mirai)", "value": "ff35b6a7a296397bce1659dee7aaabb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846292, "uuid": "6080a7cf-1340-46bc-abdb-0fe28d2aed6b", "comment": "Malware payload (Mirai)", "value": "946cc9777df90cde529ec331d65327741de6e1d1bce042030ca87b4be1a7aea0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846292, "uuid": "c8aaddf1-7a03-4fa0-8c5c-c87c730f14d8", "comment": "Malware payload (Mirai)", "value": "5c2a3bacb8ac718e0447b16333842d2bfa88a515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846292, "uuid": "02fb018d-a26a-4def-afc6-86e511735804", "comment": "Malware payload (Mirai)", "value": "8872f7c8f947d6f9002234f6f69d79d5381021fb16f7abe2d77737ca8297e597ff667b15754f90ac74af5a36f7635736", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846292, "uuid": "e6586c6b-5e5e-4ee0-943b-23fe8c3c788b", "value": "T1E8B3F885FC508B57C5C652BBFF8E428D7B2A1758D3EE32039D256F20379B95A0E3A106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846292, "uuid": "707cd509-b040-4059-9f08-e802373e435a", "value": "1536:Wo9aZ8UdZK2D/CSf4V8FG7uKPoPblTZwywGil/ub11VxnjkG4Ky+s0OXllvml:Wok9dQDu4wG1PoguxxbCml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846292, "uuid": "366a2147-ffeb-43b8-a43c-3d8ab7428d91", "value": 108940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846292, "uuid": "86b374f7-a597-46e3-a34f-f0c36988b26c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846292, "uuid": "798663df-6684-4fb0-a97d-796b71132cdb", "value": "nuklear.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dec4dc-da46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765865828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765865828, "uuid": "118060cd-b377-4699-82a7-414f7c12a210", "comment": "Malware payload (Mirai)", "value": "17f51fabbf90ab8a0d37e5e06a97daed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765865828, "uuid": "a4f2e902-ad4f-4df3-a49d-1c27360749db", "comment": "Malware payload (Mirai)", "value": "94f44cdeb7dd3d293afd978515e8ff97ca46baa325134fd25e52b68de3ff3601", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765865828, "uuid": "98204afb-ef7e-4866-9f43-9c2d76621f3b", "comment": "Malware payload (Mirai)", "value": "b60da177b66b4237c8955d22008279cbac15a6a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765865828, "uuid": "2dcc8886-1f27-4e38-88b6-6b2ce471cc48", "comment": "Malware payload (Mirai)", "value": "19564c8a09a64ac3b1e91b233b542751870f9f90553cf5e017c57566adf4a25e8e0be3e3c418bc7b6d6d4be4a14a4b8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765865828, "uuid": "39e3aadb-d1a6-4dec-80f0-0949b5407df5", "value": "T16504885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765865828, "uuid": "1b67b321-6738-4366-9d01-fdcbdef246ad", "value": "1536:Cl2JvnXPvLuQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/znt/Y:Cgv/0cwZsCK9VRhAX+bShFSP0HbbnlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765865828, "uuid": "f72747c6-facb-4929-875b-d84429aa8a5c", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765865828, "uuid": "fc6e4d11-eb42-4f00-a433-15964e7f0641", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765865828, "uuid": "e751b9fe-08ba-4d6c-aa9c-43a3c6c8cf39", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d9f1ac-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879673, "uuid": "854242c3-8a3e-4097-b901-a605e355fcc3", "comment": "Malware payload (Rhadamanthys)", "value": "313dc947b740be46237c181d4e35973a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879673, "uuid": "2061a241-62ad-4aa5-a21e-6eb0abe44320", "comment": "Malware payload (Rhadamanthys)", "value": "954304bf81346715dc52c90f6a2655f9c2c8d9f4f666dcf3a8c584f57792bf10", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879673, "uuid": "83fcaae0-d67c-41f7-8a26-426ecd7419e3", "comment": "Malware payload (Rhadamanthys)", "value": "cb7e2f4d14a7c27d0f5b04bb58c8d3ecdecf2531", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879673, "uuid": "96fa38af-1e55-4f05-b813-608ed8cbfc75", "comment": "Malware payload (Rhadamanthys)", "value": "ec0d750ba354c02763dd09dbff0541a631e68b1ea929ec022a65f2b05644a7afe6660a29458bfc80821e0e0e108ba695", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879673, "uuid": "07d3a063-e6d7-4193-ae37-ec0e83fed06c", "value": "T167A30C485D538BAA2A12B1B93E9DB2A445671C67210117F1480FF351F60FB90EFE2FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879673, "uuid": "3d22da9d-a1a7-49be-8468-50600fb6854f", "value": "3072:GDB7b01YkYkrF/YWYZUYZYsYJYZYIYyUq6BkQWkp:0kT1F/fEUYlk+nmvWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879673, "uuid": "478036a7-af4b-44e8-94f9-997741bd9f40", "value": 98752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879673, "uuid": "572d3dd7-4e48-4f53-99b4-918cb9f0ff4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879673, "uuid": "6321b7fe-c910-4440-b08e-79635431f590", "value": "invoice-1637482117.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6588331-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879969, "uuid": "37da6330-ea67-42c5-82d5-beead6217c78", "comment": "Malware payload (Rhadamanthys)", "value": "24c45a6cbf7404042c1d57bab6f48269", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879969, "uuid": "e403de65-b21e-49c7-aa93-8880d27b0fe1", "comment": "Malware payload (Rhadamanthys)", "value": "95993f4b8f28439833a888e5a598317e767d38b8676d0409a1509392ccfa7d72", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879969, "uuid": "96565bfd-b33d-4ec8-a87c-60d296e9fac8", "comment": "Malware payload (Rhadamanthys)", "value": "f716f5e39f9dea168a6ee536286e91203db38a5e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879969, "uuid": "36555b61-e39b-4f1f-8600-136451e1fd08", "comment": "Malware payload (Rhadamanthys)", "value": "51a759f6f636b01f6b0fde35a5d72b27ef3c9116f8b8a13cca3c9379e4abc93b43e66ca57c3874b2dad727b68f377a47", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879969, "uuid": "aed9de2f-b0f9-4d57-adc9-93a847b008fd", "value": "T19EA31B225F6B1DD330183E05ADD045BD9D1B6513DA4F9F4E810EA7E1E90A3BD098BAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879969, "uuid": "61cc542c-085e-4854-9603-4219068bf938", "value": "768:GDhd0i7J4sYKgY/CMNfWd/87MrXzDrMf4oHu7ElYACsKfSLAuAAroQW+FF+Ec+0G:GDB7eKg20Lr3rMf4PFACVf6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879969, "uuid": "b1708e44-3059-4bca-8474-d70aedc2c582", "value": 102081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879969, "uuid": "88eeaa68-1f61-4e73-89d9-57515e17511a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879969, "uuid": "02c9de59-298b-4f00-a17b-cff58ffd4e26", "value": "invoice-1637482117.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f682d4-da75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765885664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885664, "uuid": "0a8174db-ab6b-41b7-8b1d-556f40ed921b", "comment": "Malware payload (Mirai)", "value": "1759db6444d26b2299cae10a8876a332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885664, "uuid": "a9fa3d9f-8c43-49ba-a319-c805df410412", "comment": "Malware payload (Mirai)", "value": "9685bb2aecbd8ca4ef62c7a23a8c4ad91f0668dde0b5b891954014bda3fd65c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885664, "uuid": "23b0c6da-d133-45dd-8fa4-f351f23fb539", "comment": "Malware payload (Mirai)", "value": "9af7059e9a3d91fffb8fb1cf3217a7375b213bec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885664, "uuid": "12064d13-f485-4874-9f77-2494a3978ac6", "comment": "Malware payload (Mirai)", "value": "2eafd2295908f1cadd88f266e7a71ff1de8c3d391e31a6b6acd25518e1be6f194057b7ce4a3454b40496937cc0d304c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885664, "uuid": "545c9f49-5946-4c0e-a05e-35b688a583d9", "value": "T1AFA30715BC419A22E6C06677FF8E539C331E23DCE0DE7503E8246767BAAB4360E39449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885664, "uuid": "474fb570-6dd4-47dd-ba0c-aaa6d0d07271", "value": "1536:FnsJfYFLtohzzo8S+d1KohTsitip2EIwnNJGKxvT8ndo5:Fngcto5Mpnmwitw2jw3RT8nm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885664, "uuid": "6369cde0-8034-461e-b55d-6a81cd0b3716", "value": 99504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885664, "uuid": "89727894-1c90-4f69-b95c-4a0deffbd050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885664, "uuid": "42f66e58-318f-4ae4-868b-f20eb1bd2579", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ff0401-da3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765861371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861371, "uuid": "058acf68-f451-4407-80b8-f58ffcd2ccac", "comment": "Malware payload (Mirai)", "value": "e70de4c29c9026ef5fae1c9dcacccf85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861371, "uuid": "8fb8470c-3885-4872-8bd4-4bbf2895b135", "comment": "Malware payload (Mirai)", "value": "974cd340bea51c5ce61c81f38a1a94c235606cff5785c4db15b242f8db76f8d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861371, "uuid": "dadb92f8-96a1-4e83-a6f0-bd416ea06168", "comment": "Malware payload (Mirai)", "value": "9ae4bf60654dc80753e9ec2ebbe67e65a31caada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861371, "uuid": "61e37a30-38a4-4115-b952-a0a9fabcb41c", "comment": "Malware payload (Mirai)", "value": "271331844d200a383c8519c410a7bf05ea1cb8346e0992eb3f300a722b873aa39c808445686e2e947941ec783d95c482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861371, "uuid": "15742ee3-1c62-463f-90fb-3fdf8d5ea471", "value": "T1BFC309C7FD00DAF9F80AE73B485309097130BBA649515E373267356EED3A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861371, "uuid": "81d802a8-daeb-45ba-8bd2-dc716c4a4fa5", "value": "3072:IxCbk+L9MH5cqVmjbixLrmSio2PV7HTpyLS5Yu:ICL9k5cgLr1+lNyLmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765861371, "uuid": "588ca39e-1ebb-4c64-9921-37bd90130839", "value": 128140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765861371, "uuid": "be33aaac-7b8d-48f9-9325-312e8276841e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861371, "uuid": "905e1c66-06f8-44dc-a91c-4d99295b72ad", "value": "nuklear.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce63516-da8b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895361, "uuid": "c08c8f49-0c42-41fd-99df-2061ecf50753", "comment": "Malware payload", "value": "d9235a17b7229af80f1d00c89dad8d57", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895361, "uuid": "e193c095-7a91-454d-928e-96e6ce92bbc3", "comment": "Malware payload", "value": "977c5464ffc13300ccb8ca5a6585d154c0307fe637c9d34b65b9338ab88db4d2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895361, "uuid": "91d32b5c-f2d9-4620-90ca-763b2b143787", "comment": "Malware payload", "value": "5ea77385cadc5ef1d02d63c093822d3ed6c02c9a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895361, "uuid": "837772db-a8c2-43a7-96c1-2f9ff28d8d02", "comment": "Malware payload", "value": "8c86e25fd42568571f7c3b116255144038ed901591a94686bdb87318eff251643bb8f1c697011fa4703e7b56dddfb2cb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895361, "uuid": "c68d48d1-93ff-495f-8be1-f4c0a47d4630", "value": "T1E5D502BA58B2A9536A904563EB0F2C0A339F29D53B24D341EA41915C7F3B1D3CE96733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895361, "uuid": "9cc6b6b4-2248-430b-889b-e78f86903930", "value": "49152:GOc2yD4lTPjuupAYQWFRpUKzvuO2WeDmWowjzHRAjlj6i:GoyEFPNpfZFnUc0WZ6LRA11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895361, "uuid": "b1c5d283-4d4a-47e0-8812-40473eecbfbe", "value": 2927094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895361, "uuid": "06366055-c176-426e-8500-814b57256d40", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895361, "uuid": "f033809a-dfb5-4d4f-b292-7e453b67f548", "value": "file.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418625e7-da53-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765871156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871156, "uuid": "c56aa19b-521b-4a22-a00a-106ea535fea6", "comment": "Malware payload", "value": "0ac41e7701db7941ef801b4fd8ba2c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871156, "uuid": "4507bc50-7bc7-4992-bde2-d4755da98efc", "comment": "Malware payload", "value": "98053acfd18280d5843bc30b50e34bbbe8f94ed1ad99a64f66e602a61daefeb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871156, "uuid": "c3af7058-946e-4b99-b770-87865614ddcf", "comment": "Malware payload", "value": "b8ab31992f7bcd910d5b18d9ec6eb3c51ed58182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871156, "uuid": "fd5af4aa-3822-4753-bb27-d902e60773f5", "comment": "Malware payload", "value": "ee6cfb724abb080d649a002ed91599581ad4da1dfa7ae71d4e906f74fe3123405b6863bb9c179547a2199ed875228747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871156, "uuid": "118b5e98-2d5d-4169-907e-63260d854536", "value": "T1D6C633662B98CC52E3B1B2FCD080E75EC665B2902F6EC743CAF10C55B9AA7C5EC25351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871156, "uuid": "808333ad-2671-474f-8b1b-3a91c71892cc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871156, "uuid": "4c02e548-2c22-4d9d-b6c4-c381b6798feb", "value": "196608:S50W8UAF+bT7urHmIQ3qemdUSCtz4Jkz9Rwpr2Zwl6CzoMi6DmjPM9qLpmOn2t:SaW8l+X7uCI6mdUSCRLwqkqkwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765871156, "uuid": "9fff414a-5ac4-4f3c-bb67-d56fcbc62ba4", "value": 12036140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765871156, "uuid": "4e098e70-3438-4acb-91a0-7cec047e15bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871156, "uuid": "6f7ea186-0ade-4d5c-8230-d768fe86959f", "value": "valorant_hack_v1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d596b6-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916425, "uuid": "3851ce16-ddbd-4761-a573-fb6cb34dc404", "comment": "Malware payload (Mirai)", "value": "dfa13212034b0e0809b0ce7f52dd7c9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916425, "uuid": "a98b4ae4-62ea-47c0-a44c-84832f828564", "comment": "Malware payload (Mirai)", "value": "98ad2cadc594e95381fb98f514b2fcd6d64f6c69e45567438e279cb19d295d8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916425, "uuid": "3c3c485c-ebbc-4bc2-8af8-3f4f387353c6", "comment": "Malware payload (Mirai)", "value": "d8de8adad06340392061432a16095f2af3fe0774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916425, "uuid": "e75dbe3d-bf8c-474c-bf4c-39c22accfc6f", "comment": "Malware payload (Mirai)", "value": "72dffd861e9b283fbeafa07820ef33cd676e11975013b419657bce0f1677792d726767126f2469213fd517287ecbc9cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916425, "uuid": "8e5236e6-7d78-4f1c-ae5e-060900491ab2", "value": "T1A5732B85F9C745F6C9078934A0ABF23FCA31E57940709B6DEF4DAF22DA27B01911229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916425, "uuid": "cf2ae7d2-cf39-401b-87bf-b91f0d1350e1", "value": "1536:Kt+qZs87flIJGrw7VODopsKqhG/A1SttmxavigkRMSlfQ:Kt+grLqJGrw7EDop4hGBcaqgkRzlfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916425, "uuid": "03e6fb85-ba9b-4f01-b746-a1e76bf8210a", "value": 78608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916425, "uuid": "2fc69639-45cd-4b50-bb84-e9a5675ad532", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916425, "uuid": "2ce84932-7fa5-451d-9a29-8747de8a89ad", "value": "Fantazy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc0df40-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879958, "uuid": "7ea2e5f6-5e52-444e-8de1-3f29fe81656d", "comment": "Malware payload (Rhadamanthys)", "value": "efb8d35d9cfbeb35bf77cbf5e4a1d25c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879958, "uuid": "886ca0eb-7bb6-45ef-b15b-42044b4c87cd", "comment": "Malware payload (Rhadamanthys)", "value": "997d43a6a782a532044be9f7256ebaf16bbfe5384e65974594940d4bf8c3d805", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879958, "uuid": "981355ed-64a1-43a6-8e69-f8cdd8aad038", "comment": "Malware payload (Rhadamanthys)", "value": "f3665161fcbab0ffdd609e00ee30ea841fb45a8f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879958, "uuid": "6a12a27f-90f7-47ba-b18a-b76b9b95b2c9", "comment": "Malware payload (Rhadamanthys)", "value": "a181d9ae5dcec64f4a8656c4b9d44a2b1caeeb41c387861fb51c57f330c46d6b3851175e5a6b0dea5a5bb949a137f17a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879958, "uuid": "81a11b60-1efd-42e1-bbcc-127952c112f8", "value": "T1C7931A122D22647D26E7F0ED2EDE844085DAE6E34E51FCE2C42EF372805D7EA79405DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879958, "uuid": "4941ed48-bbb8-411c-881e-7fc863766045", "value": "1536:GDB7eKg20eQdB/GYG13Sfwt4L/Y9FWoGPalPbu0iiRWDJ5FAWcpvC3rHuOrL79dB:GDB7b09nTgdTp6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879958, "uuid": "f50d7c3c-b178-4a2b-9a67-6adbeab73084", "value": 96828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879958, "uuid": "64e33942-bdc8-4760-a907-50c7acf5bb04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879958, "uuid": "2c40b9da-9077-402d-8080-6295130563c5", "value": "invoice-1637482117.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a237d325-daa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765904819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904819, "uuid": "22f2610a-4ed3-455d-a2a4-4c23026b71ee", "comment": "Malware payload (Mirai)", "value": "705306193ccc02138075da8d8c462e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904819, "uuid": "085d3822-416b-4e16-b46e-767e59564150", "comment": "Malware payload (Mirai)", "value": "99d74045e0d06fc97add4e8b6b5a2d4387656f93d9ede0eb528156c2dd96ddf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904819, "uuid": "daa2ccbc-8657-4d69-b976-3decb09f557c", "comment": "Malware payload (Mirai)", "value": "3aefd5ffbccd438e6eba5768eded85bf13c40a4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904819, "uuid": "2e0802db-8798-407b-9e14-d56665ed01ee", "comment": "Malware payload (Mirai)", "value": "01556842a7689ee46daddd242055067ff16ccaa7a30455ff17e5f711912a9393ef0d029c614563373ae6633e67de3125", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904819, "uuid": "58a298bf-c264-4f34-b622-b9edf2fc2313", "value": "T130B33D87B31C4743E0524BF6AE3E27E88FAE6D6051E8BB8C241B360D4677C764445EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904819, "uuid": "5e24bdf2-4352-4950-ada6-7711c8c0d9d7", "value": "1536:YAY1kEf+4sKyQWp1skP+nPjsWSdBsivZVKfwNL38nTo5xEEf:01rsJt1lmPPasiRKw8n85xEEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765904819, "uuid": "24be2e7a-cbe4-46b4-a6a4-1c7777895c36", "value": 117652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765904819, "uuid": "60bf25f9-8ea6-4593-aff9-28cc3a8b3467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904819, "uuid": "55d0b33d-31d8-4b22-bfb2-962ea711d4e9", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227968d9-da77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886566, "uuid": "6ded6ec4-fba9-4992-a0c6-761108c10d0c", "comment": "Malware payload (Mirai)", "value": "2086952dcc2cff34e4b386cc35a4c3fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886566, "uuid": "dc818f2e-4a5a-40fb-89f9-fb4d65cceb1f", "comment": "Malware payload (Mirai)", "value": "99ff9a99ff8c3f85ad16c6e88399e501ad8d992c6bf9a73a13e78d690b555c4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886566, "uuid": "ec9aeb1e-de8e-4fe2-a2ed-a9a394f91149", "comment": "Malware payload (Mirai)", "value": "6e3f9593ca3d54e4ced31efa9dc6fc43aad2400f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886566, "uuid": "ae3223ee-d08d-401b-9d1d-35e97e16103a", "comment": "Malware payload (Mirai)", "value": "12ae4884e186614cbf26c9dd00e6e507ad4e7d5478654e6160d81a3c52ac5bc6b6dd8b894dede8cd3c5c269e9d9ced93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886566, "uuid": "9acc39ca-ca1f-4395-aae9-2af2eae44fd7", "value": "T1E5A32BD6DA83E07AF4250431E0720F32CA35FA7A06B9DB87FF6457304D216219665BBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886566, "uuid": "df31c8e0-e5a1-4217-9995-67b3cf9eafbd", "value": "3072:/a3nMs+vsoY1P9AC9FZnB+45ntNItRmXZoDg:/a3fYsoYx9AC9FZgGrXZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886566, "uuid": "8f033660-4e0d-49e2-8342-2bf9ad6eae1e", "value": 99248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886566, "uuid": "af70792b-16c1-4ea8-b05c-85e06394fecf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886566, "uuid": "a6a6bcf4-d1b7-4df5-bda9-965697ff10f7", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15584ada-da82-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765891268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891268, "uuid": "851fb181-7bdd-465a-87b1-389dec5ce50a", "comment": "Malware payload (RemcosRAT)", "value": "940278a8b9127c39073ea8ad4c00989d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891268, "uuid": "27854d0b-f20d-4797-8f9e-1cb8acf561a4", "comment": "Malware payload (RemcosRAT)", "value": "9a4bc322d63b9c4f9688f158f77513fb0e8159fce262e01f8aeeb85336d42321", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891268, "uuid": "37a32988-193d-4015-bdc1-36a80e9dd369", "comment": "Malware payload (RemcosRAT)", "value": "6b958fba62a9707b9faf521aa1610e142197bf3d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891268, "uuid": "b36fc482-9b17-44cd-9fea-8f9ebeffcafb", "comment": "Malware payload (RemcosRAT)", "value": "00eb9015d7f398189f3aec00b3cfc267630bc483d317755306e384e3edb15c35ea372f8f6a56ba2c54c3de75610919e9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891268, "uuid": "eb8a40a5-2653-477e-8f29-3cd854a1e612", "value": "T1F105BE38D9926D6672B791580B2CD5F884C7E9492C5125CE84220B7F3F4E683F7BE236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891268, "uuid": "181bd8ab-cf1c-49bb-86d8-8e00048abc09", "value": "24576:QVWn95hlJ5um0gF1bLprhL/ZVZGd9gjzl:l5FZdrhLxV35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891268, "uuid": "410f0d55-ab79-4b1a-b257-249fec014c29", "value": 874050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891268, "uuid": "b6a2b105-e615-4d9e-ab20-f02a96f9a2a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891268, "uuid": "dc6b4dba-fa4e-486b-ac60-ea44f92b6152", "value": "9a4bc322d63b9c4f9688f158f77513fb0e8159fce262e01f8aeeb85336d42321.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891cc647-daa1-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1765904777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904777, "uuid": "75a5b026-2cb5-4333-841b-29411ade0005", "comment": "Malware payload (EternalRocks)", "value": "fc77ac0eafd2cebdbf07269e81d18c55", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904777, "uuid": "6b626b64-9d15-4c32-841f-8827f9f67cfd", "comment": "Malware payload (EternalRocks)", "value": "9a887eb34cab7538dcf8eb1a35d27738f7dbc78d269b8e33a5851c11557069de", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904777, "uuid": "83018953-560c-477d-b580-caf9ec225b2b", "comment": "Malware payload (EternalRocks)", "value": "e8a32a5b587cecb11f28149628b90f85b095ced2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904777, "uuid": "b9a0730b-d6d6-4688-9ad0-5cf7c0d87c1d", "comment": "Malware payload (EternalRocks)", "value": "773f8b44a394fbebb097f0e05db6bd890c16328c5c57f8ee80d625ddec3a7359098d09043c94a350afc6f30d837530a5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904777, "uuid": "2b65cce9-b344-4a7e-b019-ebc435fe26f3", "value": "T17415E903AECFDD6643D2DAA3E6E7D10CFDA4A09D611B7AC4B6EC81C55070E950788E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904777, "uuid": "66dd8bea-97d0-4926-86d5-5c88a93e0927", "value": "12288:tG3El16QsM4N0oGj26iVc4G5jXgEkS/WaNaRl7W6SHQJimbfCZ1Xpjj:0fQsxAscDJpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765904777, "uuid": "cc78540a-8757-4873-a441-b41f0b8c1144", "value": 887470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765904777, "uuid": "b080d7f3-979d-446b-b2f2-023c39f7ff33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904777, "uuid": "1cdb5df3-97e6-4f49-bf2f-91a3d580f8b9", "value": "f3iifdmbe7mf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5842e91-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916421, "uuid": "6910d492-cdcd-4530-9a19-40f22b2bc061", "comment": "Malware payload (Mirai)", "value": "339a0a9cf093d07b2f0ca24a4a94ea5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916421, "uuid": "62390b3d-64c6-488c-868d-8b0becc6eaf4", "comment": "Malware payload (Mirai)", "value": "9b51caf8e94f32dab03ffef1c66022182ce2876bd1ce474721f52c3f336e03fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916421, "uuid": "ca2ff0c9-bc18-4c94-9b78-f5c89a87a4b0", "comment": "Malware payload (Mirai)", "value": "d7508c9a1de5da13c5f73a135e186307ce48aaf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916421, "uuid": "252a0ea9-33eb-44c8-99b8-a944d10dcb52", "comment": "Malware payload (Mirai)", "value": "ce551a4d2e34ec5b1a4cc067fe966cf8813159ed09025ad158481487395ccae870aaf61d57958b7d0df7207b31a369e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916421, "uuid": "a9c49634-d43d-4b2b-a8f6-8ad190da365c", "value": "T1CE831986BC819E11C6C51377FE2F108E331267A8E1EE7312CD141FA4778AD6B0E6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916421, "uuid": "c079509c-187c-4168-ada3-8a98e71ff893", "value": "1536:dtn4hRfby0yZAui3V/S2I6G+unXo/VdOU31MorFnBPyl7IzSIFiNTVm1bFy:6RfOBARdtXGH49dO21Mo5BqLTVm1bFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916421, "uuid": "a780afbe-d988-4928-8310-f5570070e835", "value": 87344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916421, "uuid": "c59b91e1-c934-4148-acdf-34b64810326e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916421, "uuid": "f6737bc3-506c-48b9-b7eb-803a5564c7c7", "value": "Fantazy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a83e54-dabb-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1765915807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765915807, "uuid": "54299b40-dc03-423c-b339-e1bc90a96f7b", "comment": "Malware payload (ValleyRAT)", "value": "c4ac8a04a61c9bcc7c446178fc306257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765915807, "uuid": "d111116e-7300-4281-af15-5efa0462c2b9", "comment": "Malware payload (ValleyRAT)", "value": "9be8761eff0892c85a59c3ea51ee9080749684802282c8e89996f702fe9ccda1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765915807, "uuid": "9a6bb4fb-b9e5-499c-a210-20dea2527375", "comment": "Malware payload (ValleyRAT)", "value": "94127c0d52865df7e0b65c7eeb6ff33c526fb2a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765915807, "uuid": "db87a750-9f75-47a2-a4e5-55b7ea1f6968", "comment": "Malware payload (ValleyRAT)", "value": "f65749f153983b61b52ed27e6e7fccbb2abbccf400042f1f67861c8592d2942bfaba06d0e585d7708fb143e015a9d434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765915807, "uuid": "7a273dbe-cfba-459a-aeec-72d6dd26857b", "value": "T177947D91B688D071C22315354F67E7B7B7FEB9608E22468B73D46B6D2E32181EA34713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765915807, "uuid": "c322df9b-48a7-4043-a6b3-69fdcc05ce62", "value": "f77c8e28106772e90971456563e2711d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765915807, "uuid": "893f72be-8452-451b-b317-651ebf15ecdc", "value": "6144:msxuZmVTlXbSEcTCkYVNAapFnnzu1Kl1rdpmHWdf58jVejggJqvSeKfl8cizfJeG:mYhCYdjnC2jMHWdfYeOvSeKN/qJeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765915807, "uuid": "1e8cfed9-83fc-4ad2-ac2d-e530e33ea99f", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765915807, "uuid": "db780e19-edbd-43de-8677-1e943b1307b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765915807, "uuid": "24039703-0235-4654-9192-2a368526f902", "value": "9be8761eff0892c85a59c3ea51ee9080749684802282c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca79695-da7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765889026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889026, "uuid": "f003f6b8-3cf2-4aeb-83f9-64c1f7d5efbf", "comment": "Malware payload (Mirai)", "value": "27b9cf5347050b09a53f84c3c51aaa10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889026, "uuid": "d56e8516-0ac9-44cf-8435-ba03b7a25fee", "comment": "Malware payload (Mirai)", "value": "9c0dfe8c8734305e016f3c7c888d8bc2d3f3d35e7161a763d3de3ac1de30f1c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889026, "uuid": "72a31412-edd6-4089-a7fa-98b9f11293c5", "comment": "Malware payload (Mirai)", "value": "76530e31b69017a67f3c276b214b6edd291cea39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889026, "uuid": "c6b01082-df84-4850-82f7-d35cfed3a40c", "comment": "Malware payload (Mirai)", "value": "4f194fd36f80f0ac67eddec97de1758ed462cad44028d3433a25b193ab1cb0a0457d1b9777d4605fe3a24f04328be4f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889026, "uuid": "60db3896-bcda-4634-8714-4f674d8078b6", "value": "T151B319217E419A16CAD766BBFF5E629C33275398D3DF7207A8281754738702E0F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889026, "uuid": "5d189830-96cc-460c-a532-1f48c2257eae", "value": "1536:9l9iKLetYiLDCPY3Dbi/IH152jzzNlcsbaufTM6oSNUDyv808nTo5Jdoo:9l9tSyIH1Y/JeSfTM6oSNcyE08n85J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889026, "uuid": "31a79233-78a5-4aeb-a418-58a38eab5cc4", "value": 112372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889026, "uuid": "dc98c431-c2bd-4d09-b0fe-91661f30ed87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889026, "uuid": "d5f3e193-a2dc-4b6f-94f6-13855fb2f963", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1597403b-dac1-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1765918327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765918327, "uuid": "de1f3579-9459-4959-ad9a-fcdd80985aed", "comment": "Malware payload (ConnectWise)", "value": "889a4336af6c11ef6e006d57e3cb564c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765918327, "uuid": "b034d185-5009-4472-bfef-7f9d0ccca6f7", "comment": "Malware payload (ConnectWise)", "value": "9c7e937cfffb6272148da9212af1f0d5876a05a4e6105cad6da9f31e18876d5d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765918327, "uuid": "c518975d-ed20-442a-9bbd-3c044a59b7be", "comment": "Malware payload (ConnectWise)", "value": "c6c8621ada317009e073110f579794a5d01efbd8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765918327, "uuid": "ce85f3d7-a0ce-4617-852a-7746c688b6ea", "comment": "Malware payload (ConnectWise)", "value": "c3f8b5e11570df7b729cf5cf3e22f6d30cfaf97339bbcb09d99c9678401bca3ae460ee48ab3882e5078bc38193121e20", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765918327, "uuid": "f590a13a-c4c7-4a44-8c30-2a7c6096b3b2", "value": "T15EA6231126E89134F6B31735FE3A56F55A3ABC25DD23C12F1268B91A2A73D808D72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765918327, "uuid": "a445500e-b81e-4a3f-a65f-fde1dbc41769", "value": "196608:hsuCcGaDp9mcYMD5suCcGaDpPsuCcGaDp+suCcGaDp:yuGVhMDauGpuGeuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765918327, "uuid": "6ac3fabf-c6be-4c83-8b61-b1249e7f121c", "value": 10059776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765918327, "uuid": "9498c575-38fa-4b53-8d31-422894baa899", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765918327, "uuid": "1098bade-eabd-4b98-99e2-5b8a23170e30", "value": "statement.PDF'.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a231b3d0-da8b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895370, "uuid": "50df3523-1a32-4ad3-8f31-a34071da0b4a", "comment": "Malware payload", "value": "2e503ffff54d3fbd3f62807b7bbe2e34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Ymacco", "colour": "#DA3D84", "exportable": true, "hide_tag": false }, { "name": "Ymacco", "colour": "#7872FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895370, "uuid": "1f087007-08c3-425d-915e-da5cba43d874", "comment": "Malware payload", "value": "9ca8f42e3d4182d95d3a8f33df161e6d52e5678174d87cd6d6315e1b374532c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Ymacco", "colour": "#DA3D84", "exportable": true, "hide_tag": false }, { "name": "Ymacco", "colour": "#7872FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895370, "uuid": "09eb5707-06df-4d75-94a2-e40b636ab201", "comment": "Malware payload", "value": "dafa5135deda559aaaf7ac80218272193277de8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Ymacco", "colour": "#DA3D84", "exportable": true, "hide_tag": false }, { "name": "Ymacco", "colour": "#7872FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895370, "uuid": "c5cb2d49-3154-4d50-9666-8ff175ceb164", "comment": "Malware payload", "value": "bcc595273077e8133d32688f331821f46261af87b57b8806f0866d70e104699441f420a1aae951a4cbac832d78549c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Ymacco", "colour": "#DA3D84", "exportable": true, "hide_tag": false }, { "name": "Ymacco", "colour": "#7872FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895370, "uuid": "68d95989-ff85-4ac7-9da2-022947559fbf", "value": "T1E8A47E20F681C036D4E705758EFEC63A552CBA71071861CBB3D81A692EB1BE27E3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895370, "uuid": "96a2b474-b190-413a-859e-fa9c1514c40f", "value": "d32f7e2af7c1f508186cb6fe40d15c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895370, "uuid": "0e7f48a4-e6c6-4034-8d16-90e07b6d2c38", "value": "6144:IcFZe1R6iJzTrL/ZvNkyjHdeOA/EiTJfhkrTBJlsvcN08Sp1Xtb/AU:1Ze1kiJzT3/ZlkyA/E/rTrlBMdb/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895370, "uuid": "f8ccec7f-ceb3-420d-9f7e-6ce84cab22f9", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895370, "uuid": "1bd674f3-5605-42e9-92ce-05ad41d801b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895370, "uuid": "7e0ec0f7-b465-43e4-9445-749d7540f70b", "value": "Uninstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2082c36-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916415, "uuid": "75df7ae5-b2b3-4f3e-ab9a-f1e96acf5132", "comment": "Malware payload (Mirai)", "value": "d9a6c5c52aed71d5ceef22e4c7cd2a4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916415, "uuid": "12e85258-ef58-4fa9-8d70-4a781ac8bdc2", "comment": "Malware payload (Mirai)", "value": "9e794fdbae88d594f54e5b2c4d568e2d552e14063cb66963b21f78504a248434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916415, "uuid": "76ec2a3e-2447-44fe-b821-ef5ea0f3b504", "comment": "Malware payload (Mirai)", "value": "9cc978af041af0eb757744675ab7a8508b0dfb9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916415, "uuid": "e932554a-824c-4de0-8316-773487153f3c", "comment": "Malware payload (Mirai)", "value": "c95b7ca98edce7ad04c6c960190c9b39106477fdd56d1de806c91329d85630b1af760ebf49061265ef0a6d28e5e2d3af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916415, "uuid": "692f0750-113f-401a-bcbc-b558b14e844e", "value": "T126638D76D578AC60C00889B576A8D9B44703A804A6F77EF1CAC29F59080BEFCF1497F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916415, "uuid": "fc36f6cd-7c47-4991-8545-83efdd835d7a", "value": "1536:P/THhka1wt+nxjYraYEfNSmJemJjgjSYKLC0my:PbH+Grx0rn+9emmjSYKLsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916415, "uuid": "7a540afd-472e-4619-97f6-579b7a539e68", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916415, "uuid": "96ff415a-c864-4d62-a932-fd628eceb220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916415, "uuid": "46778d19-2420-4306-af35-9d8a6fea5aa4", "value": "Fantazy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a48724-da2e-11f0-a129-42010a9c0007", "comment": "Malware payload (Floxif)", "timestamp": 1765855278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855278, "uuid": "4fdfda5a-6341-4519-98f0-6cffbbb77a2c", "comment": "Malware payload (Floxif)", "value": "ad30b9250fec84193ebec8bed2a61140", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855278, "uuid": "a43570d7-bafc-4994-8cad-82ef7d0b4f0f", "comment": "Malware payload (Floxif)", "value": "9ee9e8e2522fec43a24f7c3742d01acad4cf6d8444a23d130b329f03f7103e35", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855278, "uuid": "fbf64c0e-d872-4884-8298-e8e3f5bff3a1", "comment": "Malware payload (Floxif)", "value": "514ba84a3ec083e8e0ec68f5725ebdd87edf5bd8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855278, "uuid": "96324218-14eb-47d0-8444-0f3b21e34a3e", "comment": "Malware payload (Floxif)", "value": "325a6f1c9178bd48ea534448857d6a09b12abe3d39b6eefd51f64e9682b4951d818be0651f17da01e8259a73dfbca5c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855278, "uuid": "1fc45161-177f-424d-8faa-d00ef38305b4", "value": "T15CF35B216652C579E19200BA246E177F967EA933130F10C3A3C45E9A5E309D2EB37F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855278, "uuid": "ad270064-39b3-4a73-9431-ba9ec03d93e0", "value": "cc6707df676bf2856f4ea7f70f359ef1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855278, "uuid": "6ceb9b91-b28f-4fa8-963a-46e61589c14b", "value": "3072:oJ8IMILmCa3yx6oFEdgVXnF1P1duA9TSiMH:bkmCaiEoFEd+FhuAgiMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765855278, "uuid": "c2ddb88c-20c2-4ce6-b593-a5bc12f9b42c", "value": 160473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765855278, "uuid": "78cb6695-2f32-4243-8203-e4744eae25de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855278, "uuid": "0ba3c2ce-2c08-455d-a3d2-b9d9ec6dcf66", "value": "symsrv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056fdecc-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879645, "uuid": "355c6e2d-9392-414f-9fca-3a580f2064d6", "comment": "Malware payload (Rhadamanthys)", "value": "a31615a769a1f70bd4cb761a467c9dd4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879645, "uuid": "6d18b66c-3b5f-4d53-ad3a-c9c37d387474", "comment": "Malware payload (Rhadamanthys)", "value": "9efb399f4962bf7db3b30572c67424721d86dd877c54b2394f03ace1e65140bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879645, "uuid": "c808f830-54a2-4f40-aa61-2a9535de76a9", "comment": "Malware payload (Rhadamanthys)", "value": "86bb89ee3bc8d1e2d8d025c22b567fc14ca2f742", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879645, "uuid": "688da060-cb1a-41fc-82be-6254ffee34c0", "comment": "Malware payload (Rhadamanthys)", "value": "b341cf09529ebdd69ce29a71203d9358c330acf795e9575b814d4c9e00daa1025d88d14c1b612a192e408a4bc2403290", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879645, "uuid": "f61ce1fb-7229-4593-b3c7-45e057eb44ab", "value": "T160A31A4A7910B4F0C65B17E57C3EA0F78E5BA9062CA5A2C64C4B77B1E0DE39215CC2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879645, "uuid": "1dad2808-090a-4fe0-b141-96a266f18b49", "value": "768:GDhd0i7J4sYKgY/CMNfWd+6SrXKLrS7G1HztALMyZlWDSLAuAAroQW+FF+Ec+0FY:GDB7eKg203SrArS7GZtAL946BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879645, "uuid": "1c319877-8bf8-4aeb-9c76-3be92b360ad1", "value": 100685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879645, "uuid": "8b9001d5-7e8f-4163-ade7-87967976d909", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879645, "uuid": "57f34228-75f3-4596-b195-4673aeacc52a", "value": "invoice-1637482117.pdf (64).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2202e838-da82-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765891289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891289, "uuid": "a23410b0-b754-4c1e-9cc6-f33483c14891", "comment": "Malware payload", "value": "f35cb1323321f6e967ee3dfbd9c3cbca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891289, "uuid": "0c1136dd-8326-4674-b2e0-51edd2112e66", "comment": "Malware payload", "value": "9f8fc345a7d257fad979ea329ca3d0e2f0c321c792e90391ef111b9110deeda3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891289, "uuid": "149e8a01-ccd3-4578-9eab-b4c516d00867", "comment": "Malware payload", "value": "5745b489fec0e17ada9cdb5fc818aa1634574be9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891289, "uuid": "22c797b6-13c6-4a96-bce0-19afba255b64", "comment": "Malware payload", "value": "e174b5ec6f9d32c19a1591077a566ae66f715b73ece74c94b8a927601886aee07fb4f820dbc5ea857f1fd24f1dd1422b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sufficientblessings132-duckdns-org", "colour": "#9F081F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891289, "uuid": "19a88fde-f84e-4e1f-acc3-c96da59b9a47", "value": "T16E243AC454BAF34A0FF1F37EC1AA623EF3160F9F6644405AB81C97204BB927A4A56DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891289, "uuid": "b25c2cb3-0ff0-4c22-a021-44befccfa822", "value": "1536:mPg5aljrHlrrohH+2ttWr+q4Xk0JD5k4ARS6fF:D5aRSDtMrp4yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891289, "uuid": "3c31dcaf-1d12-4180-acca-dd1f46a84aa6", "value": 217494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891289, "uuid": "9e712f77-3396-4a73-8336-8c9f74c468a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891289, "uuid": "e988eed8-ef68-4086-a54f-c261f1cb96dc", "value": "9f8fc345a7d257fad979ea329ca3d0e2f0c321c792e90391ef111b9110deeda3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4314ed0b-da50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765869870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869870, "uuid": "c2ef337b-ff71-46ca-aa67-7ef520926970", "comment": "Malware payload", "value": "578175ee3cc9f8d0854c45b12307a0b3", "object_relation": "md5", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vproj", "colour": "#984EB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869870, "uuid": "ad794d8b-9846-415f-9a96-c9109e6e0d62", "comment": "Malware payload", "value": "9fc15d50a3df0ac7fb043e098b890d9201c3bb56a592f168a3a89e7581bc7a7d", "object_relation": "sha256", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vproj", "colour": "#984EB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869870, "uuid": "5a97b250-2476-4cfb-8120-34887342bbd5", "comment": "Malware payload", "value": "5472e7fb4175fe926653dc9aa705617059c3724c", "object_relation": "sha1", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vproj", "colour": "#984EB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869870, "uuid": "ccf4d85d-4528-4a66-a760-59746d7228cb", "comment": "Malware payload", "value": "cc1e8aa8bb422bd1819151c9dd47fc82d2a764f0a31b6daa7529e91a863ecfbf3a5afd5d2ac56c4fd8721eac04d8b50f", "object_relation": "sha3-384", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vproj", "colour": "#984EB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869870, "uuid": "0a332aac-c112-4578-a35b-d06b49bbc852", "value": "T168614040C52643C6DB328A72C7E75B0AF7BB98BD129F041588BCC849F4B0E6A473E817", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869870, "uuid": "610a0914-52cc-4e69-80f0-5787e451c922", "value": "48:cdaBb7l2lSlhlbJmFROgoPbz7eJoyHcym1+xLMwepvlIlQlzlbqPbz7/XsMHWywi:ou1mFEg+xcxL/o/Q7L27hGhlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765869870, "uuid": "b3b346ed-a546-46e5-9101-803d304703ec", "value": 3471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765869870, "uuid": "c28ca9c8-2a5b-445c-b15e-367f9761bf49", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869870, "uuid": "fd5505a9-f4c6-43c1-ae94-31333fe23ff7", "value": "v.proj.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd691d6f-da7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765889027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889027, "uuid": "073f4fee-29dc-4c1a-a4e2-9c38ac979f44", "comment": "Malware payload (Mirai)", "value": "aba00e6755e7b2bedf59c5ee149219b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889027, "uuid": "bbdd8937-1e37-4e50-aaab-2b029070a232", "comment": "Malware payload (Mirai)", "value": "9fc942bc528b1fd7d547f91ea55cc9ff7a20ccd3e2de1552e7fbfa4582214b9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889027, "uuid": "ec089182-d9b8-4526-87b8-df80fd2f4232", "comment": "Malware payload (Mirai)", "value": "4ab184e5bf7df5cd6cd29b4dfc32018c0c1df511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889027, "uuid": "d3c879a2-685b-4705-8531-1b6bff31ad1d", "comment": "Malware payload (Mirai)", "value": "a0531b99b43b8b0d7d964f2fe8f8be1d7cf2f6505c4e7b3ce6006c6a56402699dc9dd84f491a634e9a5b25936343229c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889027, "uuid": "f6b05da3-de1a-4726-97bc-386e497beeab", "value": "T1A7C32A057C819A22D6E7237BFF6F029E332A5394D3DE710BAC201B54779A8270E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889027, "uuid": "6d300487-9839-4739-bb26-d5e546558edf", "value": "1536:Wn7Ol2Md392ZB2oLyEj7LFVBt7Hzzdqsx0fvkVRduzdEfB4f8ndo5fY:WnKc7jPFjNTufvkVRdC2fCf8nm5fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889027, "uuid": "00f87ce9-ccc3-4eed-a691-ca43b11c9d39", "value": 118644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889027, "uuid": "186f71a0-0c5b-47ad-9996-5054e4d886c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889027, "uuid": "6b36ab46-6d01-4192-9a15-a5e7f13754a8", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746da794-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765852773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852773, "uuid": "378d9e87-5e4d-4193-9b50-cfb22e060ed4", "comment": "Malware payload (Gafgyt)", "value": "10a9eb29d48821816d603ad8268d3e82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852773, "uuid": "9aaef4a0-54c9-48ff-b0f2-5ee4cd8721a0", "comment": "Malware payload (Gafgyt)", "value": "a017ca80bef6a67437a4f6cff8a9ddf87e3cc0ceaa25b8314d93622c3bf127d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852773, "uuid": "14a61a80-ef40-4fdc-9c85-643d794b6be5", "comment": "Malware payload (Gafgyt)", "value": "4ca61cdff3d9f997d06763cbe1168ed3653925b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852773, "uuid": "b299b689-f7f3-4296-aae3-2df1a4c8c123", "comment": "Malware payload (Gafgyt)", "value": "e809ca168b41216834e33a542a383fd1ca1fa2b9893ee253e736460a0ff93e080eff9dddcd21b0a85555434e46a7939b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852773, "uuid": "f8fb2c22-9ad3-44d6-bc4d-86cc8d9215ff", "value": "T17DA33A41F841871BC3D327BAEB8E479D3B3956D467D733116A386EB42BC27C82E29521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852773, "uuid": "2206eb1a-083e-451f-95ab-374fbd68b6bd", "value": "3072:YhDJsL+PzGznfTzPmt9UmZRqQmDPRXXkQX:GAkzGz7zPBmZRqQmDPRXXkQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852773, "uuid": "c812780a-4c67-4d11-9fd7-1d5fd81ddef7", "value": 101980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852773, "uuid": "8b9a4637-090e-41b8-8a26-76f16cf40329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852773, "uuid": "496aed13-5ec4-4a4b-952b-bf7c53d56757", "value": "Fantazy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dd3923-dad8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765928419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928419, "uuid": "f19a338a-f174-49c1-ae41-9c093f70590d", "comment": "Malware payload (Mirai)", "value": "8c63b7a5f4608996748b5bb0e925faa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928419, "uuid": "da161599-523c-4cd0-b99a-bea77710bbb9", "comment": "Malware payload (Mirai)", "value": "a0b90bc23e17bccc7dae01aafbe9081749ba33a02ad4a5e12c0eaa68f1ff8a67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928419, "uuid": "5d1c238b-625f-4187-9c67-f62de371830e", "comment": "Malware payload (Mirai)", "value": "de02e5593caf0e2353c71121f3c0cb3b7766cadc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928419, "uuid": "3b949f97-0802-429e-afe3-653baba3166f", "comment": "Malware payload (Mirai)", "value": "cb032f2b57a67e1abea5a1c5427ea804ee9a8330aea01cd073e04fb7e1b3c934e1deafa68acdf1382daf77a916584b3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928419, "uuid": "9a16bb9d-0c60-4248-b81f-f28240ae236f", "value": "T186D33B12BCB57E3BD0D460BB52D38533F5BA1B0910A8C62DFC610D9E9E35960266F6F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928419, "uuid": "c6419cde-7650-4549-ab87-2ccb77042f31", "value": "3072:VIn0zNdbGfMrR1LAYDs7++zoKGHM4hjNEBMMMMbJ:7BxcGxX2++zoKGs4aJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765928419, "uuid": "b299a792-720c-421c-b65e-a6d39d4056e8", "value": 132300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765928419, "uuid": "2c55e643-d7f2-4598-8c0a-326ea2e97c5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928419, "uuid": "e0a3d968-1756-494f-a987-e68e574f4bf2", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437a11c0-daaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910673, "uuid": "e267b35d-f386-4455-a422-ba0c43950d5c", "comment": "Malware payload (Mirai)", "value": "5296d1d73dbf76a25288a7669c081b50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910673, "uuid": "38a90ce2-80e1-475c-b05e-e5a2a7845a98", "comment": "Malware payload (Mirai)", "value": "a179b6b2d2b3d7ae3ec4e1a1e3afd2c043696f9c9f9b80ed20e893744516594d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910673, "uuid": "5f609494-9a17-4fd4-bfa4-bc2214ae043e", "comment": "Malware payload (Mirai)", "value": "ef28088f8b73cf9709b3f77dbdc0b7696438dfdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910673, "uuid": "12b844ea-ed5b-4761-8b72-38c9a6d6a45d", "comment": "Malware payload (Mirai)", "value": "a4f7fb7acb2ed75356b558a2eac7df887d0be4552eaa865dd0a9d569278aa330dfb29b9c9cfcce9d603c7117813e06d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910673, "uuid": "640a8cfb-318e-411b-9209-7efee01a1172", "value": "T18AF3D60EAE219F7DF2EC537997B34F20D95A1A922BE4D560E1ECE9005E7030C586FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910673, "uuid": "02e9f784-6c32-4b28-ae85-718141c407e9", "value": "3072:qgAimeipuEuU9M7FWaPuj7JHe2rGk0fX9Fk/sCWN770jVU6m4kpBXtbdfTlgUXyH:qzimei4S+VHqm60+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910673, "uuid": "90170e89-9f45-420b-987c-39c471b0d188", "value": 159624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910673, "uuid": "b86b6f0e-a343-42e7-80f3-c83505556253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910673, "uuid": "8978b2e2-225e-4f36-84aa-3504c8ba32d5", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ef5a77-da47-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765866301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866301, "uuid": "e3d5adaf-afec-4079-a4d1-cc9590876086", "comment": "Malware payload (Formbook)", "value": "17c2716d7eb02553e53e113ebb324816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866301, "uuid": "0a462d3d-3338-43b1-b380-8f08d78bd763", "comment": "Malware payload (Formbook)", "value": "a2409687a21c586de638c6b5b3c9c09167fbbe9ddcdc22ff3c0a761572634600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866301, "uuid": "60d23721-ddb3-4db8-a533-611e46f81421", "comment": "Malware payload (Formbook)", "value": "9ec46469c0ceb5dac9f2d03eb32664717e3b9e9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866301, "uuid": "aa6ac0f5-eabe-4c60-8010-31554714a8c4", "comment": "Malware payload (Formbook)", "value": "ee0bb15db528c916ef80c6574133756089c83394da6fa1f9bf81951451896a1c6e7534a153e213539ea7f496cd184a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866301, "uuid": "5f698b95-d274-4be9-878e-18508148a899", "value": "T1A9F4F1C83F21771FCC628932C964EC7896111D796206B9D365DB2B6B77CC186DF08BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866301, "uuid": "8c3c7b2d-4df6-4db9-aba8-8d4c1dc6057f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866301, "uuid": "2cac7739-4fa7-4e1d-baae-45a82087748b", "value": "12288:2k64LAl9rIIpt6b1e1qbprhsWLioYW7anL7e/FFK4N54t84Eahk7n01y+gNhAmXR:KabfQWkNYzmxDkzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765866301, "uuid": "fe988498-3ae0-4374-be47-4a0b5d23ce54", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765866301, "uuid": "0dcd1f1f-f67a-4637-9c45-33f1135b91b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866301, "uuid": "d92c1e6b-c358-44f6-9549-29a3eadca2d7", "value": "VESSEL INFORMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd438a12-dad7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765928084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928084, "uuid": "83abb16a-8339-43dd-a807-e6443ee9fe4d", "comment": "Malware payload (Mirai)", "value": "662f3fc73b7187db81e7b66d05e18eea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928084, "uuid": "48383aea-4b1a-4f61-b909-b9b4598290d9", "comment": "Malware payload (Mirai)", "value": "a2752bb66d0d3799e2cf304c83db33b9bd8734337be929d418f25d2fea9fbf0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928084, "uuid": "f6497b6f-0591-4ae4-9e32-073b4cdfd2dd", "comment": "Malware payload (Mirai)", "value": "1590a64b3b997906330b0648cbf8311aa45e8368", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928084, "uuid": "bff0c857-ca9a-434b-bc05-6648051b257c", "comment": "Malware payload (Mirai)", "value": "c39c7cd3ae8031d37d9b94574dd61cd07f5b7b436294660782d983ce42909749232e77fe57ab734f4329974e8c4cd9b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928084, "uuid": "391f78a4-8e51-4f58-b651-5351c00e6c91", "value": "T13AD48D99FE5E3D42D2C7E33DDF4947A1222B75F4D72742B26941424DE8CAEE8CBA1210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928084, "uuid": "6ca8e84f-e822-4234-a7d6-0442cb2bb1ad", "value": "12288:SSAXJKOnYfRl6VxRbDUDZCdyuFQDRIQ4uFvIYks5Ez0+:eIa7VxuRBIQ4u1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765928084, "uuid": "f3377249-a437-4f57-8272-43583fcf1ea6", "value": 599952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765928084, "uuid": "1de2e0c0-b96f-47e4-b799-b2935754c952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928084, "uuid": "49b56080-b13a-4445-a36c-f571a3f45f5f", "value": "SecuriteInfo.com.ELF.Mirai-AEF.41678375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2d1c1b-da54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765871629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871629, "uuid": "efa7e933-b6ad-48d8-a374-a00842e3931c", "comment": "Malware payload (Mirai)", "value": "bb556427b6edf91cdeb32fc2a3e2f922", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871629, "uuid": "dc9c8208-9cff-4f72-a631-e0c3cab80739", "comment": "Malware payload (Mirai)", "value": "a290473152a45a20cfb20cc2633006e3419509c92144ae5ce2a05fc86331022e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871629, "uuid": "c84b483f-75d7-4744-bed7-9e57f4ee7f73", "comment": "Malware payload (Mirai)", "value": "89f5ff3bef2c49c93f074429feacd0097672343b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871629, "uuid": "083fcf84-3865-4529-a029-5b115ba03b80", "comment": "Malware payload (Mirai)", "value": "f1d813455b4c2485a4c9952fd960111103cf6e790d43908a785034b405e162c02f35914ca3584839524d8149443ef777", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871629, "uuid": "74a25520-6d2d-434b-9f87-9294f05e0458", "value": "T131014CCD1280676986CCCF0BF7934A6E24454ACF4A891BC93DCD547793C4AE4F014E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871629, "uuid": "81e7d594-c960-4c56-b481-378e5326348b", "value": "12:KSs6wZj8BpFej8B8NyHe0fj8Btswj8B/SYeJB/j8BgpLj8Bwynj8BL:KSKZjzR67wsUSeLHpH/yjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765871629, "uuid": "51cd852e-580b-4b54-bbe6-230db86bce39", "value": 842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765871629, "uuid": "76f0fa7c-81b0-41ab-90fe-de5f1235ef5f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871629, "uuid": "1107463a-3309-42f0-964a-2fef85e7f39f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afd85dd-da8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765895787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895787, "uuid": "f32351f9-be4e-464a-9a5a-1d6dbb41e5b4", "comment": "Malware payload (Formbook)", "value": "a9262ac8fbbd3f1d72e64047b612b952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895787, "uuid": "c5b69801-5e10-4a33-9ec8-8f4f51b5c8c2", "comment": "Malware payload (Formbook)", "value": "a2c80e14a0e837887fc9836c96d218db550c2c806cfe28e323cbb305010620d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895787, "uuid": "1a1994d3-6dd9-4b82-a5dc-985d62eeec2e", "comment": "Malware payload (Formbook)", "value": "081dd7286b19fffc9aa4389f3c6c5162e254061d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895787, "uuid": "f1085ae5-1342-43a6-b76b-c1e160251e6a", "comment": "Malware payload (Formbook)", "value": "e1602dbf639a8ceb55d0a8b86f6139b6cc6b60bf5b9304590d41e12338920da0032bde7b9dee51064eb1a1d9f9e3643e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895787, "uuid": "782897ef-6299-4e7d-a14c-6e4221953df1", "value": "T19F45BF027381D062FFAB91734F5AF6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895787, "uuid": "64a04be5-4cfb-4b3b-b9ea-1b6057be4cb9", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895787, "uuid": "6a8f9608-51f9-4c93-bbf4-1c9a734aa045", "value": "24576:l5EmXFtKaL4/oFe5T9yyXYfP1ijXdaX+lzUF0zr6ca4up8I5pw+TR:lPVt/LZeJbInQRaX+lA86LDpzs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895787, "uuid": "c07ff180-4089-4d40-8774-5a5147feb2af", "value": 1253888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895787, "uuid": "9e34b844-5074-454a-a5fe-98838ff8c8c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895787, "uuid": "41c53b7e-a5d6-49a7-a7d3-9a3979b769b1", "value": "MSC NTN SNR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd270eab-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879551, "uuid": "b47fbcc1-1074-42dd-a682-4a6401df32ba", "comment": "Malware payload (Rhadamanthys)", "value": "acf704c1eb76d4675d0ee2d24b7c7b85", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879551, "uuid": "dc23dbfc-e7c6-4c63-83f1-f2984eda5797", "comment": "Malware payload (Rhadamanthys)", "value": "a3bc81e9ebef0280a664f674ff6edbe26908408260a5aee78fa9cda7cd685dfb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879551, "uuid": "090fdbc6-a254-4210-9c6a-4c4e73b7f364", "comment": "Malware payload (Rhadamanthys)", "value": "1270646f834f6973a7029e11a5dd90cfb3eb5093", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879551, "uuid": "503a54bc-f81a-4595-9b85-52f1343c0e77", "comment": "Malware payload (Rhadamanthys)", "value": "14b2609803710056075ec1c8017201ff501fe4af425ad3986bcccb26159ecb0c9c754e4917d483cadd9ddfb1b73d8c80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879551, "uuid": "1d4765d7-80a7-4e8c-9890-78e456c99f04", "value": "T166A31A5C8D17BFBA19CBD560EFBC17E2CB58B54B5958B01A390893F28099725FC089E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879551, "uuid": "4fb99d08-2d64-4fed-bd8a-d78c59d64dc6", "value": "768:GDhd0i7J4sYKgY/CMNfWd6G57AMrXe2rOwfjHO+Am1iJSLAuAAroQW+FF+Ec+0FY:GDB7eKg20tr3rOwfq+Am8J6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879551, "uuid": "e4365bbc-061d-49cf-9c9d-1f3f021ea634", "value": 99520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879551, "uuid": "890277d6-2734-4dfc-82f3-d91fa05c2ea6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879551, "uuid": "dc0efa55-29ed-496b-a91f-082a87ed1019", "value": "invoice-1637482117.pdf (79).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1e98d3-da49-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765866825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866825, "uuid": "97c6f2e2-0b39-492f-a7e0-6afd8d0cb2c8", "comment": "Malware payload (RustyStealer)", "value": "44f726b4fd39ae985d026ad0ace5142b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866825, "uuid": "943202cd-148c-4ea2-b7e4-5e784e33b5c4", "comment": "Malware payload (RustyStealer)", "value": "a3c25b59d03904e7b450763e5864d933339f2c37c3d52e43f36bc82b417ff9d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866825, "uuid": "7439c7b9-bea0-4340-aa4b-904d7b9219c3", "comment": "Malware payload (RustyStealer)", "value": "628350259786b47118de8a42dcd71cac65c17486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866825, "uuid": "6879144c-3a8f-43d8-88f9-53e51c457abf", "comment": "Malware payload (RustyStealer)", "value": "e4e530923cfcf538e1e2f64c5ca71c49f27c076b4309c06b269d53f388b984db9d7adf5c2ccf1ddca030aabda4c25495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866825, "uuid": "b391a17b-a21e-4322-946d-5a9f18612974", "value": "T1FE5612137662B0EACAC70174E4BA83351A37823847214AF7B2C75FBC595AAD05D3B72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866825, "uuid": "61849b11-57a9-4454-b5c4-1b2d893f38d6", "value": "1e2d8b9d2b5f4b13181bdaae113cacfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866825, "uuid": "07227e6b-a33d-43c9-b39d-5fd36b5a5550", "value": "98304:XQBeRIVa81v4MadXBcKamGkQE8WzOuPwsjse1XKGVpYPKa66buuSRu1OJ6/JxaaH:XQBCP81BadXBzHGE8WzOm3sGfu+uS3QR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765866825, "uuid": "94f038f4-d553-44f1-b935-d6f5f5c922d7", "value": 6120280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765866825, "uuid": "6a8cd941-3d6d-4772-8866-0aa73a91e5e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866825, "uuid": "1d1f31d9-2b88-4344-8728-035134b8d20b", "value": "\u7f8e\u56fd\u7cbe\u6599\u5341\u4e8c\u6708\u5168\u65b0\u601d\u8def\u5927\u5168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650d761b-da92-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765898274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898274, "uuid": "868ad474-243f-4643-9cf3-b81bb9f68fc7", "comment": "Malware payload (AgentTesla)", "value": "4acafd08d3e18f599c1cb85b4f14f4bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898274, "uuid": "087da7ae-9d59-4f76-b347-4e720992ab4c", "comment": "Malware payload (AgentTesla)", "value": "a3ff9e338bd8877bdfb296295994b5237cceb01d1496dab3e4fe571c7fd8ada8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898274, "uuid": "899fd41f-f3b0-400f-8245-21775cd23053", "comment": "Malware payload (AgentTesla)", "value": "efd461634ae0c84ce95fa731b758b44f0577c924", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898274, "uuid": "cf50e694-2f51-4a44-94e1-dda7bf165218", "comment": "Malware payload (AgentTesla)", "value": "3224cc117ccd44fc07bfb414d94da746a1459326e53adaf9839db62ba06492a4f5eed6d85f359a74acd8874cbda04c40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898274, "uuid": "72b6a42a-9414-4683-bed3-fe1cb5cd4fed", "value": "T1CB340E037E88EB15E1A93D3782EF6C2413B2B4C71633C60B6F49AF6518516825D7EB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898274, "uuid": "14c4d224-b58f-468e-9f97-691a4e627e11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898274, "uuid": "f980f676-fd04-42e5-8571-c093c96d7f62", "value": "1536:z8xX36bKLKlR1Zlc+9p46cCblZ5FcChIZhQCS4eYvj686FBEe5gEKmsCSTaNesPq:gh4lR1Zlc+X4EbyVudhBEe5TyCSTqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765898274, "uuid": "675bb3d9-1e5e-4742-bbe2-e478cbd3c636", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765898274, "uuid": "6e70a303-2b41-4d79-ac6a-195e638a43a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898274, "uuid": "09ac4ec7-1a42-4ef0-915d-3665ff7fd61d", "value": "a3ff9e338bd8877bdfb296295994b5237cceb01d1496dab3e4fe571c7fd8ada8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49eab8f8-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879760, "uuid": "daf0b9ff-92eb-4317-bf6e-e65243d67fe8", "comment": "Malware payload (Rhadamanthys)", "value": "5370668e183214135cf3f5a2ebc74c23", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879760, "uuid": "5510fe0a-f3cf-4b58-8e35-ab7ef4871c9e", "comment": "Malware payload (Rhadamanthys)", "value": "a41e7218b34b835af4defb36fc694918ecb9bf2166e39197ea5d869fe70c6bdd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879760, "uuid": "13a4d2be-9908-447d-990a-0f6169c57c30", "comment": "Malware payload (Rhadamanthys)", "value": "6e390d9d33b10cdb9c81c9bf72c977c980edb68f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879760, "uuid": "bb8e87bf-27c3-4644-8eba-0614f9d30347", "comment": "Malware payload (Rhadamanthys)", "value": "c9e6bcdee23b21245bf47b6b8ab07affeba9ddb4c0985ad227f4fd8684c18c8c60cc78f6be2c121b23b20f5ed0142911", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879760, "uuid": "d28eaee8-372b-4ab8-9b13-036449dc6de0", "value": "T152A31B791D23EFFD033638D35EC61AB92525913048AE864F75A6B3362B31FA708784E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879760, "uuid": "af844c9f-b857-4822-8eac-9566e808a9c8", "value": "1536:GDB7eKg203J5JWrnriHXJrXJOsJPJfJ1A/JAJdJrUR6BkQWJ+aY:GDB7b05vMrwZ9OKRBc2brUR6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879760, "uuid": "248d1efc-b6aa-4db7-bd96-20e7fc1b9cd1", "value": 102747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879760, "uuid": "5589444d-a2a0-4fdb-ae5f-8a3de4b47dce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879760, "uuid": "2c4d8f97-e2c7-4693-aa81-992137e80b10", "value": "invoice-1637482117.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e57f15-da1a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765846655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846655, "uuid": "ae9b5ab2-d88c-48da-b350-c6680abb9d84", "comment": "Malware payload (Mirai)", "value": "d71e3b6858cce84056e0aa785cade073", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846655, "uuid": "ffebf12e-d289-479e-bf8c-2c467e2fc5ba", "comment": "Malware payload (Mirai)", "value": "a4219e617fe6e054af3305c7ffbd0d56007aefc1dc574d2918a318493c01ce88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846655, "uuid": "2d339c69-c4d5-4ea3-8193-dbcedfbd462d", "comment": "Malware payload (Mirai)", "value": "890616cf87c57059e2a47e4a8c7f610dbc706348", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846655, "uuid": "76917fe0-39f2-46d1-8818-0c231f1f866a", "comment": "Malware payload (Mirai)", "value": "9066dd64d2ed434c2a0e34ac4fa13d969d63405b13bbae7f5420c85f215897f8b508be50ba0082037c43367cd7f92ec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846655, "uuid": "f6d82300-17c7-4948-b7b2-3cdb2cfa715a", "value": "T199C309D7FD00DAF9F80AE73B485304097130BBA649925A377267356FEC3A0994477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846655, "uuid": "97d06806-02fd-4175-85c1-b9b9551eb943", "value": "3072:uVkf2kUpbZ/5yAVmjbifLLAca+fvtb5TzytA5MO:a3pbh5y4LLh19Fytwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846655, "uuid": "4c160f91-b3fd-4056-93a2-46bcee6641e4", "value": 128172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846655, "uuid": "6e98b2d7-b915-42eb-b9d2-18666e6cfcd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846655, "uuid": "e9c194c5-fa63-406b-b726-93fdc0eef6c1", "value": "nuklear.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb3add5-da16-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765845276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845276, "uuid": "0bd20ca6-cc7a-410a-85b2-86f1a84d2d5d", "comment": "Malware payload (Mirai)", "value": "54fe13e0c7f4f7b99b07e0ba664dff73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845276, "uuid": "1e258bf3-c2d4-4f64-a1d3-85c898822e06", "comment": "Malware payload (Mirai)", "value": "a475024be8144d513926d5d2c9847b55400934405d62b6edcccb994b18129113", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845276, "uuid": "0b7fbaae-526a-400a-8bfb-befd6435d379", "comment": "Malware payload (Mirai)", "value": "efd252b3d5de63a0fb8008598bc991877eaf68e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845276, "uuid": "e1cfe280-0f30-436f-a4d2-93c9acde0a08", "comment": "Malware payload (Mirai)", "value": "0d32155700c0c1d3289d69ac225f8742f440544bc2689f93aa2d1962985e220137146e3ef1e99513687730545d7ce593", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845276, "uuid": "47ffcaac-41b0-4db8-8c4a-8132d95cb480", "value": "T17FC3F645BD419B11D9D772BBFF4B52CC33130399E3EAB1269D246F5963CA1270E3A806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845276, "uuid": "dd6932ac-737e-4718-a227-5b7247dfd96d", "value": "3072:HVkBR6EWmnTro2lbfD2wDHsrwLOefgPKRmVnI958X:HVkn6EWmnvo21fawDHsrqOefIKM/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845276, "uuid": "24d6af45-a1de-4679-b706-69c32bb82b65", "value": 122536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845276, "uuid": "2a781bd3-a44b-44df-a62d-b329264958a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845276, "uuid": "722d5e72-5cbc-4a2a-bcba-b66555d24904", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a622b38-dab8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765914443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914443, "uuid": "78fe7b77-9f1a-4769-80a0-0f3f1e9a9c07", "comment": "Malware payload", "value": "78d10e4cf557109dc24637eec878edcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914443, "uuid": "9420f7c3-1b01-47a9-8dec-463e3dbe800c", "comment": "Malware payload", "value": "a508358a0786ddf2ad9496bb9374d54e71c5044df9c10fe686d43fc70484e54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914443, "uuid": "7a54fde7-65db-4ec9-900c-417641a432fc", "comment": "Malware payload", "value": "2ebb126fa2da9da60f1b93efb00700d68a2b190f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914443, "uuid": "ae348a37-a06b-4d94-bdb6-494591c60be7", "comment": "Malware payload", "value": "6152cbed406a51641b7fafb450cbe8aa42299a6db36075ba9d41f012469fc435cfc28e7520a8a3cc36a3db4296f10eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914443, "uuid": "d6a2314c-925d-4ef2-a86a-a6ac7cbb8e0d", "value": "T123E59E465658AF02E269177B08B18AC4CFE54420DECACB0F7EA47D635BDD3852B3913B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914443, "uuid": "4fa7afae-82d4-423b-b8ea-7934dfa08907", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914443, "uuid": "9655ee3b-37d9-4cfc-9870-d1adc2ed5122", "value": "24576:VQl8ASIO2M4WxQo10hfhWv1spcDVsioxbq65ZmyWCRcXtlYR1UNBkY51APXcxxCc:43OV4WxvJywcbmyXbI1YVEIDuSRM8fcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914443, "uuid": "bd95bfcc-df66-404e-a971-a9dc907d969e", "value": 3152640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914443, "uuid": "4faed52a-cff0-4ca5-9da3-f9fa94241102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914443, "uuid": "34834669-34f4-45c6-8879-34f94156d5c8", "value": "photo202512176896m.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdd746c-daa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765907741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907741, "uuid": "20906b06-0c41-4075-a9b1-827434e1080f", "comment": "Malware payload (Mirai)", "value": "3887c762ed6edbf7893856da107f40c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907741, "uuid": "4ee4b1ab-31d8-47dc-a22e-e40cbcda511f", "comment": "Malware payload (Mirai)", "value": "a571d65234e0953bf5cffce93394130c4f5e06ca4bb148727bdf1af81895c015", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907741, "uuid": "cb9eacd9-9743-44ed-9e93-7cb27b7e8cd7", "comment": "Malware payload (Mirai)", "value": "e77009b4232580dcc4f4b3bbfc4c5e318cdd80be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907741, "uuid": "f110a6b0-8d5e-415d-b23f-992e79b040fa", "comment": "Malware payload (Mirai)", "value": "88545270732b3c668384db2d6269b26b4519339e589c5f371018c6a429dc92d21537d6bc447f6e58bc1f49f40bd70f67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907741, "uuid": "33f62d76-b22d-4a7c-b85f-5155e94ad977", "value": "T11EF35CC0F243D5F1ED5606701177F7375F32E476513AEE87E3689A32AC92A42990A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907741, "uuid": "11bfb998-4a43-4caa-b9a2-cf4cade4ebc6", "value": "3072:v5fkzSMT0/49hR5IQu2tCRJXcHyVDYjsYZsD9oAXbNI+LgJNE+:v5c+8K49hR5lu2CRhc2PnXbN9+K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765907741, "uuid": "f25b5e20-ef25-419a-92e5-56f89bf3c0bc", "value": 167164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765907741, "uuid": "9c141d6f-7596-42cb-84de-3a3d313eb413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907741, "uuid": "d54e21ed-c4d1-4e8a-9fed-1e8676321306", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0718d414-daa4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765905847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905847, "uuid": "0097343c-771d-4be5-98d6-2d5a96644af4", "comment": "Malware payload", "value": "34d447e97d33a86ad1d19c308b581862", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905847, "uuid": "e65a7e7b-e7ac-4e3d-bb8d-2031664b34fe", "comment": "Malware payload", "value": "a5a499e2148ce2f61e5c1e477ab7c0c64d62606abd6c93112e1d27ab3868049c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905847, "uuid": "dd32322a-9977-4eb6-abf1-e626d16bddd3", "comment": "Malware payload", "value": "4393aaa3a0cf15e94effbe5e83ac465abe9d5c6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905847, "uuid": "a63c83b8-32aa-4068-882d-dddbe63e1ce9", "comment": "Malware payload", "value": "b1a0a6bef0dca7461760386435113432f99f5c0b7bc8550fd2da023c13735d5993763f36a741fcd0410b9a2203ca2b44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905847, "uuid": "9be6ba26-0154-474b-9882-86304286171d", "value": "T1C4B30715BC419B26C6DB37BBFFBE029D33166394D3DE710BA8205B55B39B01A0E3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905847, "uuid": "bb627db0-749d-4991-b439-9667ae606112", "value": "3072:rZXcb+O2XRIiduffn5B4ga/c7Ew28n85:rZMClqAuZB4Z/c7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905847, "uuid": "083f301a-be25-43a0-b72a-2a23352204a7", "value": 117360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905847, "uuid": "4e0366ce-e29b-48e9-9e77-57412b6990dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905847, "uuid": "f40aadc8-dc5c-4d5e-9b97-7acc75793581", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35486e6d-daa6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906784, "uuid": "d7f8165d-6307-468b-8446-bc9facf083d0", "comment": "Malware payload (Mirai)", "value": "c745a7ab3bb2b53eb7c819b8e91f5e83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906784, "uuid": "0c8f0d8e-2a98-404d-a78e-33d8c6732f81", "comment": "Malware payload (Mirai)", "value": "a5abc4d7f192c3c325f1f59d333150de73ae573185e2626ea21d9af29a4b5bf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906784, "uuid": "953542c6-915c-4739-9b58-6c5755aa168d", "comment": "Malware payload (Mirai)", "value": "53a972ea3583d5db19b2af3b5eaa24f8ac0d8a64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906784, "uuid": "f8c2a13a-49b3-4ba8-bf5e-42b4c27d8725", "comment": "Malware payload (Mirai)", "value": "12207b6c86c965bbd672331f8cc8f77842e934c79a4c3fc7252965a332dafebb22d1bbd868f53646ab357844a3525e7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906784, "uuid": "089947c5-26bc-49fe-a25a-123baafc5c84", "value": "T1CA935A2288158EA4F3894D79B4D1B538D323845266CF2E7DB5B680E042CBD8FF91F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906784, "uuid": "7c4e7cd1-5a29-4016-98df-d344b8d58941", "value": "1536:1sxmP9fvxKIp4qXhptexb68hqQmQs22U7J5ezSPTCUqr0oCaIV:1hvxfp4qXhptqb/7LdPThK/C9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906784, "uuid": "57fed902-081f-4a4a-85a0-320fe7be9fdb", "value": 89896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906784, "uuid": "eea87ece-7947-4877-b413-49f53510cfa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906784, "uuid": "db03eadf-6a16-4e0d-b2b4-ba80ec5b578f", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65671390-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879806, "uuid": "f559edfa-350a-4cd7-84de-8202c29185a0", "comment": "Malware payload (Rhadamanthys)", "value": "7ad1592a76f30b2090ebf7bffed916cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879806, "uuid": "0af13b80-1faf-428f-bee7-230c174f07a6", "comment": "Malware payload (Rhadamanthys)", "value": "a63e54830d30bb689c8251f9a441751631bac486d439ce4de00775e51b0414d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879806, "uuid": "4e390193-7e16-4b13-a0d8-d699520c58cf", "comment": "Malware payload (Rhadamanthys)", "value": "a3233c9b45033d9e3da93a28bb17a0adc28be6c6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879806, "uuid": "a8fe2026-a162-4403-8ada-979850cc1c2e", "comment": "Malware payload (Rhadamanthys)", "value": "e993f93724477b698d76123416df0f7e526e5897d4cfdf1d55c418e566bdcdb9b44fbd5c937173b73e389b1c8e08ad3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879806, "uuid": "428a7d81-8cf7-481a-86f4-5449b7b96ba0", "value": "T135A31A011D744CBF90AB393C6EB561BD524BC057D3E12138E22EE6F2C92462B67999CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879806, "uuid": "10893784-b7fe-4f36-b09e-69cf37309cb1", "value": "1536:GDB7eKg20RHQr6r99vYDXxRPNAXuNrdV6BkQWJ+aY:GDB7b0M4vI9dV6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879806, "uuid": "e20b4712-4013-4558-9f4a-d56bc4ad7b88", "value": 102116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879806, "uuid": "f65947cd-9510-4040-ae1a-220a4816f895", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879806, "uuid": "2f7be5b4-27ab-4904-bb49-5eb50d189998", "value": "invoice-1637482117.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edf07a1-da7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765887929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887929, "uuid": "ea63a877-ab55-4ae4-9eaa-a4478eac11cd", "comment": "Malware payload (Mirai)", "value": "a9e7031ebc0926a125acb6c24de420ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887929, "uuid": "24f887dc-4beb-499b-bfad-235e3e2d24a4", "comment": "Malware payload (Mirai)", "value": "a7a18b400a8169af05a973dd959df56c342a2efb3413c9cf886d32194c540cdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887929, "uuid": "7ad07195-babb-4d4c-b602-407461fbc19f", "comment": "Malware payload (Mirai)", "value": "3845529e12d5d8e0206ac1598b964ec28873e6f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887929, "uuid": "0923aaa1-d2af-4d98-a22b-54e26fbfbc68", "comment": "Malware payload (Mirai)", "value": "d8ef83d48c188a0debe17e2b11a146847567108a333a2158368399fa4d7a5d5aabe74bee0b71dc6bfdba414e5cf4482e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887929, "uuid": "cdfa7ea4-4556-4d00-aceb-14ab4e43534e", "value": "T175936C32C5154EBAE55C49F8F1914D78C3231652A78B2D7D98B68093098F98FF90A3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887929, "uuid": "98035bb4-b1bf-4fbd-a2fd-5d73b5392bcf", "value": "1536:f63cIyZxMipu9/+XNlYRHDgUbUjF5nS409wC5rpPPoCkIVE:0ixMipu9/+XNlYWjXnA9w0VPgCXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765887929, "uuid": "a43a45b2-4401-4026-a214-bf74c7e38dcc", "value": 91308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765887929, "uuid": "60048d3f-470d-4878-8d5b-c47247f324e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887929, "uuid": "3031b947-f1b4-4c8a-81f7-149cd91587e9", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c349cecd-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905304, "uuid": "27b42059-7863-4b7d-a8cc-e62fd8bfeaa6", "comment": "Malware payload (Mirai)", "value": "b33ec25dbd75be6b34d5819ff14345bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905304, "uuid": "21074d61-8e59-4470-a924-f357f63cca20", "comment": "Malware payload (Mirai)", "value": "a7b46c4bc788b3eb4dd331ec177a699343b561b84000e8613a9b99e9a1678dfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905304, "uuid": "51fc303a-0ebb-4fa7-9d72-66ff164e4733", "comment": "Malware payload (Mirai)", "value": "bb9804233986da9b447712f085dcf23aadc7d43d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905304, "uuid": "c136267e-12bd-4a9d-9d44-549cc2f9ed53", "comment": "Malware payload (Mirai)", "value": "a5ba31911e7dfef2a30cf60554833de7818cfa8739a34961f38c32ed2e39ada5a5d410b67581cc6bf3f7e00955d02fff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905304, "uuid": "aea53266-2799-4564-bae5-d1f7e47d99e6", "value": "T118B318C26405CDFDF90BA67A85F70965B924EA105F530E37A592FDE3B9220A43C3ADC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905304, "uuid": "2687765c-e70c-4625-8855-261046bde474", "value": "3072:kREMqZEw1KMeOB7mJBHvTbdO1exU/P9yTTyrNCUBpBbbYzOHX0zNFy2IAmlmfQii:Kqm1cIvC4wJo073l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905304, "uuid": "23e909ca-fb4a-4ff5-9396-31478a517e20", "value": 114228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905304, "uuid": "d3db68db-a9ae-4b71-ad06-3c56f299f73c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905304, "uuid": "d46f4df9-4bd7-4427-90a3-3424fcbfbe20", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce315580-dab0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765911335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911335, "uuid": "eeae18e8-e6cd-4b88-a757-a21976ed2b1a", "comment": "Malware payload (Mirai)", "value": "f556c8a1164c9ff14f1a0453ad75a88f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911335, "uuid": "5c5ed0fe-7e00-431d-9aa0-2845e9d8bf20", "comment": "Malware payload (Mirai)", "value": "a7b89d44513bd057491453e8b49e14c48ce9a89542e5c96000ecc732677fc931", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911335, "uuid": "fbe77923-6c18-44b3-9c31-fa9719651c3e", "comment": "Malware payload (Mirai)", "value": "7ba1f52c10a456edd670de4fb91e11d340314307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911335, "uuid": "a14edeb0-e1b7-405e-94e8-e1c2d40b8237", "comment": "Malware payload (Mirai)", "value": "46ac603b94cc5984445c3d744de459ef1dadc6fe657acc8dc06106b71ff3db139ace95eaafb3c99712f7d71ca476a3eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911335, "uuid": "d8349152-3e4e-4ce4-ab51-3975ec3c22f4", "value": "T18FC33A54BD419A12C6DB667FFF5E229C332613A8E3DF7407EA202B5973860271D3E909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911335, "uuid": "92f8b629-e299-45c5-83f3-22a646be7ca3", "value": "1536:MvM2mcKaw1dkD9GSSt2gjTwtvpzzCe//t0z27cLq0t+R5gsWxmvp8ndo5:MvMNPR1jTwtvxozWcLBcRyHcp8nm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765911335, "uuid": "8f40679e-a034-447c-a75f-dbc295ff4b82", "value": 121816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765911335, "uuid": "c0012e7e-b078-4ced-b0c0-63ed386ecece", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911335, "uuid": "f0c47f53-78a5-49fc-82b0-d198326d86c9", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaa26e4-dab7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765914317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914317, "uuid": "0082bd67-e396-4417-b42f-7646002402bf", "comment": "Malware payload (Mirai)", "value": "a70665239a4949ea2a652a17e61fd787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914317, "uuid": "5c095efb-2eb2-44a8-9676-c08c90c37a00", "comment": "Malware payload (Mirai)", "value": "a7ff3c269a451f792c9960acccad27148a07936bc73c2eaba88928aad0feb156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914317, "uuid": "eb4e56d5-48a8-4975-9256-b5af127e14b2", "comment": "Malware payload (Mirai)", "value": "3b7c96e587b912040975cfe7d7d0eae9a99ff7d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914317, "uuid": "a70463e7-4eee-4e5d-853b-33e42df82eb0", "comment": "Malware payload (Mirai)", "value": "d3d7862f6f650dd9623de75f41b2f5c434b8a7d7b7bac0b8aa9da8d49a63f5a66ff45782284e295c036f4db9e0e209a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914317, "uuid": "f68cb8e8-9b27-4365-b217-d4f381f9cf54", "value": "T184D3A44EAE319F7EF1FC53B583B34B20DE55229226E2C585D66CE8115E70308A92FB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914317, "uuid": "969ce457-655f-492b-8886-477974a79249", "value": "3072:hhtcQiNBNJjZQaY7uCpEyDAZECaQRHnDc3T4tnQo1WA84fsHHB1vjrZTewVgwaDk:hhtcQY8wi+6I03r+ZPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914317, "uuid": "ded7adb8-746c-44ed-b05f-8f7ec5b03d96", "value": 135088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914317, "uuid": "91bba9ec-c9d0-4d4f-867d-9692c043571a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914317, "uuid": "5658754f-21a3-4199-807d-d11d3e78702c", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3688ad8-da89-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765894620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894620, "uuid": "a6c1898b-bb2f-4f58-be31-494f080aeda4", "comment": "Malware payload (Mirai)", "value": "4fd5bc7e8949dd22e91b4cc2d0bdb62c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894620, "uuid": "ebb97457-fa63-4a5e-94fd-7ee116c635fc", "comment": "Malware payload (Mirai)", "value": "a87ae514cfb1b71883cc3c03a801906d54e65c8f3f14e91ee7e08023598601b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894620, "uuid": "39f0f570-1d8b-43d2-8e7e-a4be024235df", "comment": "Malware payload (Mirai)", "value": "d769638efa1bc9188998264aeac9361a0a076e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894620, "uuid": "cdf315b1-e620-4c5a-be89-b3d5cbf38cbc", "comment": "Malware payload (Mirai)", "value": "c054183be99951dbf2995e945b6769272c1b35e1716f0c28e40e9a23d397c93ebb725baa7c849a9fac78a2f6282b60e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894620, "uuid": "496b00ec-75d9-4e93-894e-93ee04dafd40", "value": "T109F3B80EAE219F7DF3AC937947B74B34DE5912922BE1C5A0D1ACD9007E70309986FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894620, "uuid": "996f2477-ff1f-4701-9ca2-818d612443b5", "value": "3072:Z84GSz0hkLpfhddm0+XSWbE5K/eKPJxD6glliVP2JeyxyI5zTddDpzomFCegh5+4:Z/GSz0ZC6LvkqkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765894620, "uuid": "b7cf7d45-1eeb-4861-9f87-c3b102ac3356", "value": 159604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765894620, "uuid": "f6663de8-6297-4c6c-88c7-9a6aa61bafca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894620, "uuid": "3642e549-0b08-46c4-bade-9f9488c204d7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5531bab3-dac5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765920152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920152, "uuid": "ede5e3f0-ce14-45a3-bc07-a400bf1bf794", "comment": "Malware payload", "value": "1c3b3104bc9554ef30b564755c5a2dfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920152, "uuid": "6e5ab4dd-cce6-4ff2-b6b8-81efa20d7859", "comment": "Malware payload", "value": "a8e355f8ca1725385acc1df6ee46edf29d66a0fdaf5e9fe3632c3028546156c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920152, "uuid": "6ab5e5e9-1ec6-42e9-9629-f38d5e673211", "comment": "Malware payload", "value": "f5fa81f0d2c99b021320a2704c8ed5b1fed95d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920152, "uuid": "c9ac11a1-670e-468d-8593-0407ed125b9f", "comment": "Malware payload", "value": "05d67cafd5ac3c8b5ef5f9d953b82fc1709abb2067c9338688b5dc80b1d6323f77ab75ad0d74df06d2845a93b08e4a77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920152, "uuid": "78dfaf49-c4c7-4990-ad83-8c0d581aabaa", "value": "T1E70633ECDB1E0398EC86D435AA96D801B94DD8F6B0AF56E6D08CE1D90A34E333F52547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920152, "uuid": "dabc4e56-f925-4db1-a5a6-add27ce23bef", "value": "98304:d9aPwPzT6idcuGrV5xF7SLIW8y/6apBjhliJTG2gKS9BYB:yPwP/60cuGrV5xAI4/FjaJIfqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765920152, "uuid": "bf4a563f-a7c5-432e-9fbb-4d33b7974ce1", "value": 3716200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765920152, "uuid": "fe63bfe5-7b5c-4e92-82f1-30abc7bce564", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920152, "uuid": "c8f1f25c-4197-4890-949e-7a69b5f13d51", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4265f672-dac8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765921409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921409, "uuid": "e60336d0-a7ce-46dc-9912-0650015b5bdb", "comment": "Malware payload", "value": "91cf11eaa1ab497991b7194802ddd1d4", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921409, "uuid": "33a38609-75bb-4fca-afda-447def71b834", "comment": "Malware payload", "value": "a92f53472f24a24d3ee850caccecec9820a592412c34798d44ec8501311c5398", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921409, "uuid": "a667c276-6e93-4873-ae16-7ef3713b9fdd", "comment": "Malware payload", "value": "24ec356042b42ca633256fb239954786205f0bc6", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921409, "uuid": "0ca749af-a02b-4791-bc05-848ffea30d99", "comment": "Malware payload", "value": "140d9d0355be2dd5bc2f15281c1f42a4d343930368570b076df2f593cb99af4a72b6a02bf5d55d2ad18dba61063825f4", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921409, "uuid": "ab0579e2-b4d8-4a4a-ae3f-e255599ed566", "value": "T1CDE49380EAB6C61DF2B5D78EF42257E1DE1B28C21560F292107A35D8B9506F8BC67D0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921409, "uuid": "16e8e3a8-3859-4e1e-99c1-87a9e4b632d9", "value": "384:FJlXgoVAAfKJ9uFM6d4XI8exCWG/9YbcXJ6Ai1YI/AURf3+tZCdV4DdxOeVqj:VX/fsw8nWLgziWlUput4dV4DdxOeEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765921409, "uuid": "574ed1a6-c51f-44c9-bb18-70003f300d12", "value": 662162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765921409, "uuid": "2bea5ff3-d3a3-4257-bb89-058df0bb9162", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921409, "uuid": "fff60cbe-c8f0-49b9-886f-474ff990558e", "value": "Contract.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9f33f4-da8a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765894856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894856, "uuid": "acb67ae2-744f-49c7-ab1f-1e7bf4362c40", "comment": "Malware payload (Mirai)", "value": "42500859bd895106243b1b4c693eb0a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894856, "uuid": "e3460793-e669-4718-a7bd-accc0125e19a", "comment": "Malware payload (Mirai)", "value": "a9e1798d4dc4fdecb977dd42b5a2dbab9ffa7eae411f750e839ecc4b39c9a913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894856, "uuid": "dcb1bc52-67d0-4b95-9376-5ffb7d43da70", "comment": "Malware payload (Mirai)", "value": "7eb019a292e213b05271e82c0a40fc5ba4381350", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894856, "uuid": "25bf7285-93de-4163-bcb3-3547eb9182da", "comment": "Malware payload (Mirai)", "value": "ce6d6e21f86290691d54c10c77c262733aa6469da7ee08d80245868ffc44bbb371e3a6fb50d3c214c67c567bae30cdac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894856, "uuid": "c47b30ad-7be8-4137-b944-15942074ee6f", "value": "T159C3E686AD429B20D9D763BBFF4B51CC331353D8F3EAB21698146B55738E4270E3A846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894856, "uuid": "933730de-ca6b-4a4f-96fc-8a44d49cc564", "value": "3072:RJblDpdun6sPqMgxHO7v416khBcp5fQrD/isr0hnVnp5:RJb5pdu6s1g47g1BhBcp5fyD/ig0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765894856, "uuid": "6b0737ec-e060-40cc-bfc2-6d0af6598b30", "value": 120152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765894856, "uuid": "7e68c434-6d0d-4d17-b511-c572753e7d5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894856, "uuid": "af20f19c-0a5d-401d-afad-b864da9c9706", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3802d6-dac3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765919175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765919175, "uuid": "8f1f4a67-a25d-4ea7-8565-e94c4ea5c361", "comment": "Malware payload (Mirai)", "value": "9f400e4af262acdb14cfe18210490b4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765919175, "uuid": "2ada0351-0c82-4ed0-97e8-8d7f930f003a", "comment": "Malware payload (Mirai)", "value": "aa0b6dccc370ec09a633505c30b90ad341903497f8ab7060f803477314f4ecb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765919175, "uuid": "f30acf3c-43cc-4530-b6ff-61e4907fae07", "comment": "Malware payload (Mirai)", "value": "701268643d6265d253b4be63a7e0518fd578a0d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765919175, "uuid": "f26c66ab-d3c0-4b66-821b-8560b38848e3", "comment": "Malware payload (Mirai)", "value": "0c4bf3daf81f8c0389e336abaefd18adeb9b07e32d886e7676672cba45c5511a2fa152dbc5dd47180613bc032a8cf775", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765919175, "uuid": "cdaa41cd-3fb7-4537-bc9f-982f3181aa15", "value": "T142A30BC26040CDBDF90B963682AFC60AA575E6928F514B33E552BCE7E92E0C47C6DDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765919175, "uuid": "904471bb-3640-4f8e-a71f-dd50278eef5e", "value": "1536:8IFSEUOiK5FiAqE5l2F1He8um1HPJXhzr4F/IQAcfMkTPyCF:8IFSEJAAL5l2FBb7X9r4F/vAKM5CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765919175, "uuid": "3239efab-c52e-48b6-841a-db76637466f4", "value": 98592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765919175, "uuid": "e898512f-56c9-45ba-a028-3d5c7df11b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765919175, "uuid": "b6f2e743-3aa3-4cc9-87c9-c0b98450cb17", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2966bd-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879465, "uuid": "66b11328-d822-46bd-bf0a-0b2fe737ac75", "comment": "Malware payload (Rhadamanthys)", "value": "25257f9ffa4d7bdbbd2ff8a8d17e0292", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879465, "uuid": "c8522d23-f300-4526-8062-a520f2df00a6", "comment": "Malware payload (Rhadamanthys)", "value": "aa5b97d5cd56c18bc7e457c27f28f139137fa2de08ef021895901bb1751dd994", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879465, "uuid": "6fd8aecc-5a6a-4557-963d-8bc5a78c2544", "comment": "Malware payload (Rhadamanthys)", "value": "d3b73fd1e988e63e23dabba914223f4e6d111877", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879465, "uuid": "2a8e2b24-0986-4c4d-9b6d-bb79c54b1a85", "comment": "Malware payload (Rhadamanthys)", "value": "e45ec45e711462cd16c643863c7d189a6507472dbd893030136897e89a11b59b2d856cb100571fb8930f3eb7adf3bfda", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879465, "uuid": "5d90110c-74ac-4c0d-8afe-4ede933f2b96", "value": "T1C2A30ACA0DE1ACF4422331C90EE7E9A9D7C28D45611EB5B1D4987A89A463A7F0CC17DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879465, "uuid": "eaf1a93a-5d43-4baa-86e3-bed0a7e9abb6", "value": "1536:GDB7eKg20MItrIr+7mCmbP1JwAOC5gjX6BkQWJ+aY:GDB7b0PGkScjX6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879465, "uuid": "634bf503-bc1d-4fc8-9bba-389d53afb8d4", "value": 102118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879465, "uuid": "06ef5abf-16ec-49db-b236-cd046e0c8c4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879465, "uuid": "3a7b91e0-b2ac-4106-b5c0-4113308b3e08", "value": "invoice-1637482117.pdf (90).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36f677e-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916417, "uuid": "5fb0f429-d82f-429e-a9d6-a552aa702d41", "comment": "Malware payload (Mirai)", "value": "59603dab774581f4244b215619abf50e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916417, "uuid": "969ccd1a-5ea5-4eca-abc2-7fcb8e60b3fc", "comment": "Malware payload (Mirai)", "value": "aab2354eb4373b0b6ac3b4ffbd9fcace62ec787b473f231f55976594757cbdf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916417, "uuid": "13749cb9-00d7-45ba-84c0-83931bb8314d", "comment": "Malware payload (Mirai)", "value": "a8cec5d95bc4c128d9e26b82c74fd65da6fb228c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916417, "uuid": "d1ffd05c-8871-4212-9c92-2516fafff7c6", "comment": "Malware payload (Mirai)", "value": "1045a0191b59919f251408967eb9940c37a1c628726067f039c0e58b961910350fb2edf120fe5e6a4425e3b5808d28a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916417, "uuid": "8ccf26cd-00d0-45fd-80d4-501db8af5adc", "value": "T1B6731714ED7D2E2BC0E8913E12F7C616F2F5360E14B4826D3D3A0F8EFB54690A5466B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916417, "uuid": "97884373-d754-414b-907a-910ac6ea93db", "value": "1536:h1yqKhS6Z6POJ0fysRwhmzcC62iyVQiFQ+wE:CqKYWqRfcCrc+wE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916417, "uuid": "f2084887-995f-4fb0-a48f-4e271322c761", "value": 79656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916417, "uuid": "db179cba-fdf2-4501-8f5a-09fb073fa1f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916417, "uuid": "1ead0ab3-d6de-4bf8-bb4b-45074e33c9a4", "value": "Fantazy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7578956-da68-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765880400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880400, "uuid": "dda4ad49-1d9a-4d57-b031-cfdf044f8791", "comment": "Malware payload (RemcosRAT)", "value": "89fd8de1a5ff730527e12e18547f7a01", "object_relation": "md5", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880400, "uuid": "d8a80219-d92a-48df-bb65-9677d5a2bb7e", "comment": "Malware payload (RemcosRAT)", "value": "aabebc71f47ca96d1e631937f048d056ca56e9f09dcbd29d39ad12bffa8ee2fa", "object_relation": "sha256", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880400, "uuid": "b0e946bf-e9bc-41a3-82cd-2fd8cc91a528", "comment": "Malware payload (RemcosRAT)", "value": "92084d578038c7778f9ab1587ad8079ef0ab0fa9", "object_relation": "sha1", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880400, "uuid": "b9d2cd63-2c20-4ada-a6d3-3efb3eb940c7", "comment": "Malware payload (RemcosRAT)", "value": "a44bac12e992a113f8736560473285de3bee546a276efa738509aa7e57d89299e7f61830cc17659ff3c3e191eede60fd", "object_relation": "sha3-384", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880400, "uuid": "0d87379e-b231-43ae-9abc-b34cdc5e7421", "value": "T1BE65331436DD21DF3BB14FB1125CC5D9B9809221CA6BCAF86AFB729D391975EB1C0138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880400, "uuid": "f9219d11-c80b-42bf-8e85-38d02c2544a5", "value": "24576:P4LzkIrQpZ68R3xucvyX+2iAsAJK8v9h0c22QuE4aFj4C8sP382jru:ALz5rc6M3DvyX+Pdus50ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880400, "uuid": "66da8c74-c3eb-471b-8403-4d459476a334", "value": 1505266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880400, "uuid": "16c2ddec-5909-4ec7-a4b7-3c2af5a1ffa2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880400, "uuid": "43010411-bf66-46c7-917f-ad5aab45cb23", "value": "aabebc71f47ca96d1e631937f048d056ca56e9f09dcbd29d39ad12bffa8ee2fa.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89dcaa0-daad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910011, "uuid": "4c055e40-e0f2-4a58-9129-9c575cf4bdd5", "comment": "Malware payload (Mirai)", "value": "7a49299206a278cc95abb28e83915458", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910011, "uuid": "2e19282c-81d4-486d-a9b5-48aadd5abe17", "comment": "Malware payload (Mirai)", "value": "aaea938b8e08a6e79fba4c1e267ca68a9d42a618d1e4253d2de8c1183d2318f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910011, "uuid": "827dc9d7-6e6f-437d-9077-eeadff4d0b54", "comment": "Malware payload (Mirai)", "value": "d4ad8070271d0f8fef122000719adc13f339f7c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910011, "uuid": "19481c2c-80ad-4b65-a265-10a8d6abbfcf", "comment": "Malware payload (Mirai)", "value": "7af3c9bdf660f042a47bdcff95c99fc49781345d940704d3f0cfaa06149abf4bb4c6c0913dd5bb8343b0381907091560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910011, "uuid": "93609539-ae16-4c0e-88f1-bf03ddd5b128", "value": "T1E5E3C60F6E219F7EF2AC537897B34B34D95926912AF1C5A4D1ACE9006DB030C686FF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910011, "uuid": "428d93e9-1132-43ca-a587-c36106616596", "value": "3072:JdSEGIbDpzhHGUNByAf7GHmj79aEWeftxzCHVCfKHilvZ0t1MXkOV8ZboyFOW8V4:XVGIbD+vuKFgxophj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910011, "uuid": "6e1dcf08-e2c6-414c-aa8c-411719f1a61e", "value": 155732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910011, "uuid": "1c0edbc2-d50b-4f67-94b0-94b98edab87c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910011, "uuid": "4330e49e-f19b-40a8-801b-85fb9c47978b", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06f8a9f-dab6-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1765913943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913943, "uuid": "05795d78-884e-4288-8478-43ee3a11d5c7", "comment": "Malware payload (OffLoader)", "value": "2cd1644b7015ad031e64eb265d03a7bd", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913943, "uuid": "26309199-a78d-422a-b666-ff84bffa0e97", "comment": "Malware payload (OffLoader)", "value": "ab2b1a840daeb5323e7e4ab215a179d15c749cfc3a0a0c3c7b2b8be5bd43c020", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913943, "uuid": "07c1ef29-074b-4ef6-806d-fa47529650a9", "comment": "Malware payload (OffLoader)", "value": "333d040d3596e20fae76eef375ab4a5b09fd8887", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913943, "uuid": "f216336c-8a41-4f4a-9908-77aeef143d43", "comment": "Malware payload (OffLoader)", "value": "535c67cc7c590546941f87506c7386dc9eb683d74cbe3e9516ae5d72925df171899f258304b1cd530b4a09f167ac10e0", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913943, "uuid": "e376e52c-8346-49fc-bfaf-4090bdd73abe", "value": "T126360223E2CB573EE36A1637D9B1B230593B6E11655B8C5296E4E84CCF39CA01D3E253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913943, "uuid": "d6fec0d8-535e-4519-8f77-bfaa6a5cf74b", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913943, "uuid": "059a5816-9160-41ae-9ce0-1b185cb772b2", "value": "98304:HN66/H2c5yk8U6fkxITdYCTE7OEAN3v5Ia:/vxD8tFTOJCPN3ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765913943, "uuid": "72280c78-46b1-496b-90ca-17666431307f", "value": 5109497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765913943, "uuid": "57b8faef-40a7-4bed-8bff-b9bfe0d464d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913943, "uuid": "e7c30336-3220-4eb1-8a1b-0b42765cec66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ae3c21-da3e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765862296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862296, "uuid": "3ecde06b-a8da-4d52-9dd5-3c698ba3cdfc", "comment": "Malware payload", "value": "a80450a6ca317fa1091ccb2c703ff277", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862296, "uuid": "99861a80-e8c1-4f78-8584-d573355a09aa", "comment": "Malware payload", "value": "ab446709f778886254df18298f8e420484a6ffe9813ec701010ed24737e4a5d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862296, "uuid": "411b6cb3-bc04-448f-9848-8f80151f96fc", "comment": "Malware payload", "value": "68c4e6d2e3c6865cefbf8fd4c88d252c15f058f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862296, "uuid": "f6b9b10c-47d5-4d38-8a55-7e122c57426a", "comment": "Malware payload", "value": "a39d1284c00dc7b4c7095345e9f0af7dc5199ef20c91848f3ed44c82c1aebd0e36e02b4de4bb9fc587315d4643688526", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862296, "uuid": "308d80c0-fd91-4ae3-a822-ba774451f818", "value": "T19383F9467810AA27C6C14F77EE1F035533328758E3AB3342991C2FB56F9BB5E0E66285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862296, "uuid": "1e9db519-eda5-419c-9e27-5946dcba7190", "value": "1536:vP/DI4+rFqynDEpfktjh8ithXRVunUM9IFBJtg3O89GsPgb+sN1tp5WY9miR:vP/8JqynDRhPtX5ZFBJtgYZVdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765862296, "uuid": "b947e647-e789-4b98-bea0-e471299086d8", "value": 85949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765862296, "uuid": "7074fd7b-bdee-4303-a956-963eb47a3850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862296, "uuid": "8fe6ef9e-e941-4a77-9270-f9145f8d5846", "value": "n7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e97dcf6-da60-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1765876735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876735, "uuid": "9389483f-e7a2-4c3f-895b-5b8a7f2204be", "comment": "Malware payload (MaskGramStealer)", "value": "c2191d4120dd411accac534c0a2d75ac", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876735, "uuid": "3c6a31fc-fc7c-4fcd-987f-ed03c916f49b", "comment": "Malware payload (MaskGramStealer)", "value": "abb8939d54062dcc47e589f1b3a738cd6f9daa721ddf40d9643ece9ee540e36e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876735, "uuid": "ef6d9679-b0b9-4f6e-96a2-e7596dcc7510", "comment": "Malware payload (MaskGramStealer)", "value": "4fe0f81a3029501a83a6d8275b6a0e3fa6551918", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876735, "uuid": "05240c09-eb26-480f-bfd1-6cc7a38cd88c", "comment": "Malware payload (MaskGramStealer)", "value": "1678ba8db1ca6e05a9bd30dce5b564a0ec94f6ddceade535a48aebb2ead815dd49bb7177f8e5036052e9e44317ad817b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876735, "uuid": "9e10df6e-20fe-40c4-b9d4-095b2881e590", "value": "T183C533AFEFE97056C82D23B073AC27C61B2A345CE4669761671CC46FB9C577085A32E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876735, "uuid": "047fdac3-60ba-4f5f-9b34-f8992b1ac897", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876735, "uuid": "7e66e4c4-0c6f-416e-8c07-0dff4b240391", "value": "49152:A8u9f5H/TGGsrG40KJcwylng0vJ472UIW0xdQ5G0WJnXiyso:A8u9fpTGA40uc/mI42rW0onWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765876735, "uuid": "aae9cae4-d71a-4b64-b154-1ee68104494f", "value": 2702336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765876735, "uuid": "a8901fa1-ddbc-449b-b667-cc6efd2c53f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876735, "uuid": "5d36d3d9-d64f-4a14-bbfb-76801589bc17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85292f66-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873846, "uuid": "ddfa6f51-f3cf-43f8-9ce5-bc67b11dc856", "comment": "Malware payload (Mirai)", "value": "a7a7bf9c6df8007ebdfd81de5e2a7193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873846, "uuid": "643838b7-5109-4c51-b088-dc29614f177d", "comment": "Malware payload (Mirai)", "value": "ac2b28c8526a7570143b1946b16c0aae98c53e89cf6d68faca8236a3b108ba9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873846, "uuid": "e40fe7e1-ff2c-4747-a1bb-1ec027ffec43", "comment": "Malware payload (Mirai)", "value": "09d93e8d5bdda18a3bfa5d513e919a893d24132d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873846, "uuid": "1330a0e1-c3b7-400b-b97f-75d851c52ed6", "comment": "Malware payload (Mirai)", "value": "a0cbc10a77d05c5ee4149abae60d87cbcae81981d4a56375a184c235a5f8ab1d5bc3a2b73a7ceaa2c4a6b7688d904d21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873846, "uuid": "f31c076b-bb80-4f1d-a16e-3a079942b538", "value": "T14E230894B9819A16CAD0537BFE0E42CD3726A398E2DE3313DD225F6137CB92B0DA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873846, "uuid": "9bafc13f-cab8-4be7-9867-4b7d34672a33", "value": "768:yEeKUK5RoV7uJOSQpcwYk0ai2sdjBfEXYgKodZ+uByrl5YZTbcykb+7ulBeHEczX:DfdoOQ5H0osddgFdZ+uBkluOxb+ylB4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873846, "uuid": "ef720eea-640b-46a3-ae30-7f4f6d77feed", "value": 47968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873846, "uuid": "4ce3e5bc-b4f5-4578-9950-986ef4eb2d37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873846, "uuid": "896325b8-5ab9-4938-b066-ab344f39e344", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc7a379-da81-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765891098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891098, "uuid": "a498704b-09e8-40c4-b39d-b05cc031c46f", "comment": "Malware payload", "value": "ba6d536c2a3a14bc5cbbdfcd6896634f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891098, "uuid": "5e5e4e86-f260-4ab3-9b79-93efebd41f43", "comment": "Malware payload", "value": "ac2f0c0b939554cf1a7c8aeae40d0b3c1e9734d1692553b596fdff5087af8b17", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891098, "uuid": "27fb0c1a-33e2-4dd2-b6c4-a5743cfc39aa", "comment": "Malware payload", "value": "f4bbae508f3701fb8d770d6f1e44e67472f6feb1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891098, "uuid": "0fd17319-3df7-45fc-bdfb-00362e1dd92a", "comment": "Malware payload", "value": "595966ad6b727b991e38f0b1a36b79fc8c739584c7900c69431dfda707aa5fe1a9171167bb373f82d32bf4ac955da004", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ftp-omrat-ee", "colour": "#95BE41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891098, "uuid": "24fab747-4dce-47b9-96af-704899c0047b", "value": "T144919EB0195F0B0F1E1E484971954674A1F6717F31AA2DA74EC8BF28AB8FF7D88824C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891098, "uuid": "0f61ee1a-949e-47c8-901b-02c11d55a520", "value": "96:JfLFdAf8p/Il3HOi5/YnOJAU9vm3HOi5/YXAZ8mmS:J43HOi5YJ3HOi5YXXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891098, "uuid": "f6033962-8568-43ba-a6ff-31764e4a7537", "value": 4379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891098, "uuid": "90fecf77-e497-405d-935a-2e19f3d18eac", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891098, "uuid": "d530bec2-5d7c-42a9-a6d7-cdf711bba60d", "value": "ac2f0c0b939554cf1a7c8aeae40d0b3c1e9734d1692553b596fdff5087af8b17.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230bcd89-da84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765892150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892150, "uuid": "79055646-f1ed-46b4-bb7f-210da7833624", "comment": "Malware payload (Mirai)", "value": "16542ffa0f97ba14d67cdfb371870940", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892150, "uuid": "2014a8b8-56cc-4697-bd21-cbf178781fc4", "comment": "Malware payload (Mirai)", "value": "ac396ff690f0b6a038378b6143791962354f190aa4ebae433749cbfb2d9ef3da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892150, "uuid": "fcdb6d01-7708-45ad-b061-ebfd3d6abbf7", "comment": "Malware payload (Mirai)", "value": "d2637107b78c0af9b2fae04e554386f7955b739b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892150, "uuid": "2f9dd596-d7f8-4ae0-bdae-e088a611d34f", "comment": "Malware payload (Mirai)", "value": "f6600b63dfccb2b44fa3310b60d55333c4185e784131a13e8f58752b7d72b9931ba8e63f66b5aabdf76fc4505b19415a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892150, "uuid": "7d39bbb6-0c31-4660-91a8-40c6d11f615f", "value": "T123934926BCB43F27D0E1ACBA52E38631F675574D12B5C719FDA10EDCDC360242A6A1B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892150, "uuid": "66706a6a-7629-4d1a-9a75-300a662cacba", "value": "1536:ZoMSxbMd02T6tqImNZVWCPrZy9vwIFP8gOBhaMjTAhDZ6XIjyBdi:Wp61TTAqgshaNUYjyBdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892150, "uuid": "f7e81eb0-255c-47b1-a3ba-7e2824644cc4", "value": 93576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892150, "uuid": "ace34960-0995-46ba-b738-7951acb6d359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892150, "uuid": "6c1dc89c-54ac-425b-9224-112deb99d541", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3088ef-da3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765862804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862804, "uuid": "d0edb29d-025d-433d-8d39-24a4eb00e211", "comment": "Malware payload (Mirai)", "value": "e24b87ea3aa06ff919c57ac5dd903b5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862804, "uuid": "661ca4cd-000e-4068-9398-6dc0e6b2338d", "comment": "Malware payload (Mirai)", "value": "ac6de3974905cf98a8a7740bcd62c7472287ac685392c7cabd406e13c15177d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862804, "uuid": "ae414102-6388-43db-bd85-19032287d939", "comment": "Malware payload (Mirai)", "value": "22306b1517fe54ae00096656b270b5cce2c62f7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862804, "uuid": "d3e59275-1be2-41a7-aecc-ec7b41182e34", "comment": "Malware payload (Mirai)", "value": "ca7fdba9e5e84d252a1be4cd857f44b783350fad79427c4692e36bb88252a134daec93be3229c7ed4162f1a2ffc6e111", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862804, "uuid": "f307ae51-98ba-4dac-9d63-410f925fb5dc", "value": "T19FA31792F801EF76F40BE77604C74B207630BBA20A535622735B79A6AE762D43933F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862804, "uuid": "8e0c239d-89a2-4ca6-8a08-4afa01f21fbc", "value": "3072:I/l2/g5q3DC3ZtTz+eURhWpyF4ioe/uh2mu2VMDrY8faJX:I/I/g5q3DC3ZtTz+e3yFAec2mu2VMDr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765862804, "uuid": "8f97b31d-9d35-4dd8-a775-6adb213e58da", "value": 100089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765862804, "uuid": "b93196b7-ef03-4c69-82d9-c40d77c0c341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862804, "uuid": "d99b906e-282e-4f81-a79d-0e5585f191fd", "value": "Fantazy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3479955e-da80-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765890461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890461, "uuid": "22b3bf9d-a009-4ca4-801a-2cd94f70b828", "comment": "Malware payload (Mirai)", "value": "fb6135a17fe77dcd4c5db82c3c90b8b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890461, "uuid": "fab861f9-f626-4428-bcaf-ff550ea6a4e0", "comment": "Malware payload (Mirai)", "value": "acaef5c639612a9e55d32f57ca1767c9ffaf02da6e16c379090096ca0ab92ded", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890461, "uuid": "0dcbf687-2c91-4838-80c0-3e22829eabf1", "comment": "Malware payload (Mirai)", "value": "e8692ba7eddfae3f2f68581acf3bb49009db5288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890461, "uuid": "350875c2-62b6-449d-bab9-e4938c7ede9f", "comment": "Malware payload (Mirai)", "value": "2fefbd52f00077b8746790ca4bc93cf6e9a26ccaebddca1e894c7a20e512fb56921fcedfbaec539b2f77d3671a91443d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890461, "uuid": "e04e50ed-490a-465d-852d-a9a17f60c414", "value": "T1D9E3C40A6F615FBBD85BCD3741E94B09189C560632F83B757970E904FA1A24F0EE38B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890461, "uuid": "b45ef8e5-11ab-449a-a0db-0e40bb14a244", "value": "1536:fYYk8fa5Egh2+vqoTsH9fnCaCXpP6uEPBBKAlRRPzg5qeXfQ1793jQAYQYa8nTo5:fYgVgY+PYfnRmfgEkQCdDYg8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890461, "uuid": "ec7c067f-256e-45af-8834-bb443bce1d07", "value": 151376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890461, "uuid": "ec642a42-2daa-42d1-80c3-70e4b26b7bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890461, "uuid": "0d2c8776-5eea-4803-a5fd-0062fa2fbb7f", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf4949d-da77-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1765886689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886689, "uuid": "6a5dd7ff-f085-465c-b7f3-9c8ec38175c5", "comment": "Malware payload (DonutLoader)", "value": "58e7acf47f9a1c15c056710919f5efcf", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886689, "uuid": "8f58a58a-4f56-4d61-b5b1-a5f835c1d9f0", "comment": "Malware payload (DonutLoader)", "value": "ad5b266e863e2e9a3e8d01691f51c72ac3272b34c3af2b583aa31983723db25c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886689, "uuid": "a9309f3d-b46e-485e-b68c-cafa04e7739f", "comment": "Malware payload (DonutLoader)", "value": "52c7584e52944265371e800ed219b206636094d7", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886689, "uuid": "9a4e2a69-64bd-4bce-94ee-cb997beb2532", "comment": "Malware payload (DonutLoader)", "value": "64c36884f6a049b7aa9544c304a14e4b79b2eceab088cb97665653f814ab4b8db576b9d4a68970dc2bc974ba386db035", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886689, "uuid": "0c0f5a9e-b6c6-4f98-b741-3772626a97d9", "value": "T180A57E19FBA410F9ED6BC63CC9424902EB72BC564761E6CF13904A962F237D09E3EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886689, "uuid": "fca38e4d-5938-4569-a9ca-5feab183faaa", "value": "9c39cacee256aea7699b759872a7c139", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886689, "uuid": "88e736ff-ccbe-41b8-abd2-880ac6744243", "value": "6144:xouIeZ7ej03GzVCjlcAlB4m+N2//8KjSIud:xouF00+V4DlBR+Nw/1vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886689, "uuid": "e22e8e6e-b4c3-47e0-a455-4fa647e80376", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886689, "uuid": "49795665-f626-4ec8-a9b6-12601e21d40c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886689, "uuid": "1c187fa0-8ada-49ab-b001-a50fd2a88ad4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc6342c-dad8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765928196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928196, "uuid": "fb6fb95b-d9f7-4d91-8bfe-b99c418376e7", "comment": "Malware payload (Mirai)", "value": "5cbd90e9d7bc57f630fcc58114ac31bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928196, "uuid": "ee123a59-8080-43a2-8700-70ac088e1493", "comment": "Malware payload (Mirai)", "value": "ae49bec23d38721a714ad4ace0cc3f6c3b683b88c59660c103a383f5e72abc4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928196, "uuid": "a8950600-b248-4c5f-8e27-a525b34a07db", "comment": "Malware payload (Mirai)", "value": "498c47d6c4abadde8a56de87a61ede7ebf63ba96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928196, "uuid": "b02e1316-f71b-41af-8c20-96e363d9057f", "comment": "Malware payload (Mirai)", "value": "effe1746466a1cc5125b5b69f8fd668ff29f4e886e8ea953a7c578e1c470df6941c763057e820619c638f49f56f6c8b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928196, "uuid": "1a009a03-5cbd-4bd1-baf3-ee46b0148825", "value": "T14CC32A96EE8BD4BEEC050171706697378B39FA3A015BDB8BDBBD99305810201865DBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928196, "uuid": "bc489456-6fdf-4602-8c2f-35b480527a1f", "value": "3072:bgapI51wtf4Fr0YXP+FLk0AFbBky+oMXKzGhTjqu3ccimpXfJA8hzaGvuAvXhoK7:E35+4Fw+KJanMATlpxro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765928196, "uuid": "9faebba0-d68e-4ddb-a919-7995f5a6f58a", "value": 119760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765928196, "uuid": "0381a0b5-ddba-44e7-ac77-ebc2826f45f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928196, "uuid": "39a39cb8-8b9c-4592-861f-03780c37deca", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2c64e8-da6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765881269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881269, "uuid": "91510db0-ce21-421e-8b76-dbdce7b86561", "comment": "Malware payload (Mirai)", "value": "f0778605e39858c7573934c55e819a16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881269, "uuid": "1575a1ef-758a-4d68-a37c-fd046581eb8e", "comment": "Malware payload (Mirai)", "value": "ae8e11bd7f4da238b8ff566ce7e4b7301a68d7a34ab81ba9da0e9cdbfbc53162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881269, "uuid": "fcc95dc3-3481-4f19-8ffb-d21eef1d1570", "comment": "Malware payload (Mirai)", "value": "0af5a14f66f0867873dd1b2a0ef0122b0999c6e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881269, "uuid": "11c27c23-4faa-4264-bc9e-c57db76e2ff4", "comment": "Malware payload (Mirai)", "value": "eca2ca61f21cdfa435655be8ed65bc7540a9d76f3c999fd79e6f9bd2f7bb8b5fbc7327822ba36c7062dc9fac74420c11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881269, "uuid": "5eaedfda-15f6-4862-a708-f05ffbb66993", "value": "T151634D81BD815A13C6D422BAF71F028C73261BACD2EE3217DD257F21779696B0D3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881269, "uuid": "2ccc8c00-e8ec-4a4c-9539-ec4852adb2bd", "value": "1536:Q7SAoBcjnMnUzG0C8j3QCU++4VoBB+05Fz0Mc:ASAgAKK/S++4VoigFRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881269, "uuid": "5aa690eb-3955-47b1-b2d3-4b62dd0c8de4", "value": 71092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881269, "uuid": "655d1f6a-7c60-4e96-a540-7724b08a0d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881269, "uuid": "2c9dc68a-c41e-4858-9753-0b3ffd12c892", "value": "karm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c0f724-daa5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906563, "uuid": "bb24dc5f-0fe4-4578-b60f-5162ab8f2a52", "comment": "Malware payload (Mirai)", "value": "6d377669acf88a0a87838ce67d4e91f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906563, "uuid": "235c697f-dab4-4785-a590-bb1d62265a5e", "comment": "Malware payload (Mirai)", "value": "aec23a7b618b43dab98e99fa88776f860b7b3a21a59d4fd8a066577ca9b2bfb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906563, "uuid": "c4177827-67f5-4d40-86bc-da54eda0bfb7", "comment": "Malware payload (Mirai)", "value": "7399da49752deef59700a353a63317a4ee7b6e05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906563, "uuid": "3d393303-6922-4c9b-b058-07510e803540", "comment": "Malware payload (Mirai)", "value": "9da7c5de8631bcb9e49c21c10f32d0604d5e183c2d97659372a3cf222457f23465a7e0494cce4953f35ce0ce5725bf2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906563, "uuid": "d11cdce3-e556-49e8-a341-704c2a39e06e", "value": "T1C7F3D648BB600FBBD85ADD3B42E84B09598C650736B83B7579B4E904FA0B54F0AE3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906563, "uuid": "9a51538f-4777-48ab-a192-ecf753e7fb7f", "value": "1536:Ss5qBEeg+Ex26tr+A8uFa2FhU007lJ4GmaePwfc+eH4alboKJ0TWYk3Rb3AKXczh:SsnetT6tCA8uFhUJ4GisUqKm8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906563, "uuid": "f0cc94b4-0246-445a-9938-f2fd938a6d89", "value": 159588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906563, "uuid": "10f086d8-e994-4ec5-a478-f481d7ebece3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906563, "uuid": "a93e76dc-5b75-4cd6-b19f-f0bd7ae0270c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de500481-da3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765861541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861541, "uuid": "83af38cc-1756-4c93-8f17-3fa15903f6b9", "comment": "Malware payload (Mirai)", "value": "1c5bff3dc1ddaa6339fbd8ae82e8ec96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861541, "uuid": "f22a10f0-5c43-4c9e-9667-747ba16b45ea", "comment": "Malware payload (Mirai)", "value": "aedc4ee444b740b91e01e2b25c8691cc2d10bf8c80f0219f43cf394e99951d8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861541, "uuid": "7feabd41-0b93-48b6-84f1-e928358c4133", "comment": "Malware payload (Mirai)", "value": "ebb55244dc86e398b81f10662a70ddb633d20aeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861541, "uuid": "bc1044d1-c8c7-4d19-9a9d-716ab9e2660d", "comment": "Malware payload (Mirai)", "value": "d61b54b0d42a7e8a6b9d8d829bb2da8446ba686e6fe334f334ee57645655e29734d36fde53f5f0474261c8f2fa721146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861541, "uuid": "95bb8848-973f-4125-9205-a9b2bb75de46", "value": "T1A8C30846F8819B15D5D111BAFE0E124E77231B3CE2DE73029D24AF747B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861541, "uuid": "f9be01ae-45ee-4b7b-a287-6f5e446283aa", "value": "3072:1iTsl4XTAuSNhb8hP8SoqVMaF4a9UTVW:1iT3X0f8hPXVMaF4auW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765861541, "uuid": "4720b172-0052-4b8b-86da-f3b652dbe7cc", "value": 122576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765861541, "uuid": "f93ae642-cf0d-4f04-81eb-8fc7369ba3b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861541, "uuid": "6781eb24-9f34-483c-859d-1342559e5b81", "value": "nuklear.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af7d838-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873856, "uuid": "c58ccef5-eb35-4b4c-a2e2-c21ab034d48f", "comment": "Malware payload (Mirai)", "value": "74cb3066ab38a2a7cb9e15d58f674cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873856, "uuid": "68b2f32f-d7ea-4450-96e6-1e309c4aa206", "comment": "Malware payload (Mirai)", "value": "afd8e1df2a2005281bd90eca40e1cc436084b851412aabc1625cbdcf16e67ea1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873856, "uuid": "51ff9a2c-8336-4110-89b5-13f49750f5b2", "comment": "Malware payload (Mirai)", "value": "4c1adbf03dfdb02bba0ccaf86392fbd384d66a80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873856, "uuid": "55d537cf-711c-400f-8a5d-947ab7a9780a", "comment": "Malware payload (Mirai)", "value": "f1b8a594b7bba8a3c93cec53eea599b7af461a2794fda7138e232aa9fbff0935d5e79cc6b64f565396b53a8e4e7353f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873856, "uuid": "30ae74dd-b480-4a86-89d5-5c1cd1028b12", "value": "T124330B897C828D2BC5D0127BFB6F02E9331563A8D2CB7313D8249B587E8A55E4F67741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873856, "uuid": "43c8f106-8c21-467e-88cc-8d400e8ac708", "value": "1536:67nFfILYxIDJFoTBoY4JBZW1Rrx1LsTyJ:dcxkFoTBsBZQRrvLsTyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873856, "uuid": "90ac78aa-e21d-413e-9331-5ea7177fcf30", "value": 50335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873856, "uuid": "8c13457e-7a2a-464d-a77e-cf3ea21f03b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873856, "uuid": "b18e62c5-7f79-456a-9664-a339657fd754", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d9a0e1-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873853, "uuid": "45aae73b-03d4-4778-9400-b3fdb7c9cb3f", "comment": "Malware payload (Mirai)", "value": "d5145c3669493320acb9d0458dcaf0b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873853, "uuid": "fb450b43-837e-42e1-90f3-d1458d7fd2ac", "comment": "Malware payload (Mirai)", "value": "b010363874e3e62ffe95205e06dc0efd4246be1328cd450067aa5b4e53131d27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873853, "uuid": "16ea4905-da1c-4dc0-ada5-add3c19168b9", "comment": "Malware payload (Mirai)", "value": "1dc2108d481da4ffd8f7326872739edda946a129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873853, "uuid": "420ec181-46e6-4f93-b9f0-2c54872867ef", "comment": "Malware payload (Mirai)", "value": "71e27e129272117bb9d113717f3fb4978d4ca5292aed2cbb76329ad33cc8242dcc6b50c52f3b7fbd0186cc20e58b958a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873853, "uuid": "69b539fc-3426-4a35-81e2-e5f214c0abb0", "value": "T166233A035481C0FDC455C270AB3FAA36C932F47E523AA59A73E0BD326D5AE311F5B989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873853, "uuid": "b8586574-00de-4977-a297-dac703a65a4e", "value": "768:1X9qmSJDEZ/H7cwLoRlpNauVGGf49JEmFSUpt55tHe8w:fq4Z/nUnBOKmFP55tHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873853, "uuid": "2b63ba40-3323-4340-a8b9-af362c9df4b4", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873853, "uuid": "d5879ff3-1d6a-4fb6-bc9d-3600541ee884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873853, "uuid": "6a90f395-bdc1-4a5e-a19f-df8159edd26d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8aa9270-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883355, "uuid": "c42bd157-0569-477e-856a-240b7007dc1f", "comment": "Malware payload (Mirai)", "value": "7bb16f1276490dc33cebc1b53e021609", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883355, "uuid": "ec50a730-9823-4b98-a680-1a1a56ab3225", "comment": "Malware payload (Mirai)", "value": "b02c10f598aebc55e6ebc34a0b7ae7f35702bd4a0ccf4c666f4e728a649d234a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883355, "uuid": "7ad1c46f-21f7-497d-aba9-49f10d2aab44", "comment": "Malware payload (Mirai)", "value": "1374d8d5c6f8eceee1b0e12945c5dc8eb0231d59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883355, "uuid": "992a7742-bfb8-4b76-bc1f-15aca3e6c896", "comment": "Malware payload (Mirai)", "value": "a5fd30b8ea8c9cdbe45fac2e0a079d3b04a56c1318fd1b2341f24750acba17485df3f334312da0aba968a140f14a1ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883355, "uuid": "368f272d-ce04-40e7-b045-70f8ba66f24b", "value": "T158B32A82EF83E8BAE44D013968715732EA34F97A415BDF8BDBA45930DCD821285097FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883355, "uuid": "79297d8a-bdf2-475d-9de6-107afe2d6781", "value": "3072:4TJGB7ARrjBnl7DUeDcyqg4OSEEW/ZcvZOfoD:4YBsfplDJDcyqgzvfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883355, "uuid": "d9e3cbe4-f543-4c14-81cd-5780acc71153", "value": 112656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883355, "uuid": "9c9f7dbb-50fb-4c7c-aa98-def1bf46d3f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883355, "uuid": "52eb54e8-432b-424c-9e93-677acc97ca9d", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3827a7a9-da66-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765879301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879301, "uuid": "07e71029-995e-46f7-9b5c-7769aa285381", "comment": "Malware payload", "value": "cc6b57762b431dea3843a1475afedf35", "object_relation": "md5", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879301, "uuid": "6144e12a-0a10-4956-afe8-251f7b117805", "comment": "Malware payload", "value": "b1a874560944eab9b2bc28a4efc92813fec5362233c36e9fe919e743d60d611c", "object_relation": "sha256", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879301, "uuid": "158a4b4f-242e-4bff-962b-70346f5c0d2e", "comment": "Malware payload", "value": "326dc961d364dcfc0e1dd7b00a0d787eac7d796f", "object_relation": "sha1", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879301, "uuid": "9da11971-fb89-4e18-91fa-874a8e2fc9a2", "comment": "Malware payload", "value": "6cd5c263f897e11d6f9047fde6ba49e3ebda038183378869857defaf11272c063d451d93f38a45bae1ed9091c8ccd7aa", "object_relation": "sha3-384", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879301, "uuid": "db018ae7-4f69-4f8f-86f5-ee1805b42d4b", "value": "T187A533ACEE8BDC2C4BE4E09FB118D4FB86F5E983E5FF5C2996799451C905E220532843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879301, "uuid": "7f31ca4a-5117-4119-9cb0-e4f115412a95", "value": "24576:Qipd9d6iP1d1vGtFBqyOTdvvggqe3W08NZWgJqe9IebkR4daTT0Y0UPmiLbqKlXj:QU/1d1umTN+e78hwe2sQT0MxSQkvEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879301, "uuid": "e85296f5-6adc-4e0b-9bc0-a3f0a92e5693", "value": 2265837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879301, "uuid": "ff782cc2-fa95-4182-86a4-9d52c751ba40", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879301, "uuid": "dc20a9e7-f3c8-4c0c-b517-17fe1ed46347", "value": "ZECH_GROUP_SP_PROJECT_ RFQ_SPECIFICATIONS_65486_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46defd21-dad2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765925711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925711, "uuid": "1c4dcec8-3416-4ce4-bfc3-21b551a109d4", "comment": "Malware payload (Mirai)", "value": "330612a4fec894e5f415791bf781cd2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925711, "uuid": "d4fc7148-dff6-4df2-9dc3-f51bf83748be", "comment": "Malware payload (Mirai)", "value": "b256fe3516d7a15a9189a5eece46ad88ef9b6b396c6af177e6275fef83c92b72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925711, "uuid": "7854528b-9729-46fc-90b6-3213ca6eefbd", "comment": "Malware payload (Mirai)", "value": "7533d1df546c68b9b8b86f7f4b44f8a364628a56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765925711, "uuid": "40bac7d4-6ce6-4e12-8463-7838a129c1e5", "comment": "Malware payload (Mirai)", "value": "a87d3ee13481fd9ab0745854f3d56771cce101fb281779fbc670e08bdf6630c10a046231c2f1ad97625422a91d6dd2c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765925711, "uuid": "6275d984-cd4c-4ee8-8f15-b9ef358a1546", "value": "T112D36C22BCB53E2BD0D4647B51D38631F1B50B0818A8E62AFC628D9DDF35D60265F5B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765925711, "uuid": "e40923d1-a5c8-493d-999c-ba54b548c0d5", "value": "1536:GhYHSBLQgL/qmP/NA2ZenNVWzKtUdl47aUSYrF8TpgnODfFtUF1BvE9wlWpm9wOw:GWyznPXur7CUam6WEpivhjNtB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765925711, "uuid": "87a020f2-9fa2-4cb3-a209-44f1a89c8ba6", "value": 132300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765925711, "uuid": "3b854cf8-e4eb-4a05-9976-bb82fdc37b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765925711, "uuid": "ee41bde6-b44b-401b-ad90-728d912d812d", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f80c3d2-da18-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765845785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845785, "uuid": "e719c29e-78e2-4ca2-84d2-a63dd5b753ff", "comment": "Malware payload (Gafgyt)", "value": "d01941ed745cf321054033f62ab3d6e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845785, "uuid": "b3d06270-3669-44d6-8d84-bdfe3ca2eefe", "comment": "Malware payload (Gafgyt)", "value": "b2a499696489970d331eed809cf0ea9df81fce7b5e1e4bb74b6ec258cbca8d72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845785, "uuid": "76be0039-6216-4edc-bad5-54ae89933e6f", "comment": "Malware payload (Gafgyt)", "value": "dd0ace288b113a3d449056dcf7a88739753caa3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845785, "uuid": "ab4e1818-879f-4860-b2cb-244e16b0b00a", "comment": "Malware payload (Gafgyt)", "value": "dec2cc8cedc07a34eae08484670866dec4c82a08aecc2113ec2f1f9ce8ac699b531c93b15de0528a9e1c164a1ccf22a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845785, "uuid": "914b2cd4-85cd-4455-80b8-3bf1a4e10f55", "value": "T1D1933BD89AA3C6BCF8E9043250F29F794B34FA6E00BAE797DF249571EC54302920575E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845785, "uuid": "1e509921-fc1c-4706-ac40-f80a12f494e7", "value": "1536:XYOtxaomC8eUHUZYz1yNoFJo819lzMwAjpUr6t+8oKE6ZoD:XYOSorTeUZBqO81olOelfnZoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845785, "uuid": "ff551ae1-39a4-450f-a452-249a9e35ea86", "value": 90768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845785, "uuid": "eb47a5ed-a1e5-4cca-a704-4c99b8ac01b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845785, "uuid": "ad0d46ff-1711-4559-999e-0dbdb3bd6ecc", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f177499-daa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765907740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907740, "uuid": "56b7e58d-9171-476e-8040-48096b4b36db", "comment": "Malware payload (Mirai)", "value": "28a5fe599da754b1dc6c3dd81438ed23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907740, "uuid": "5ed28ee3-4f40-4199-968f-ce63c61f2bd9", "comment": "Malware payload (Mirai)", "value": "b3a351ba975876c908f91127f6db479c44b3fdd70158ad4b36800e118b56070b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907740, "uuid": "c45366cc-f207-40db-8321-c10c96a5a06d", "comment": "Malware payload (Mirai)", "value": "42776ef2c901091eb005e4be1725c21bd81f1d3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765907740, "uuid": "2e1640fa-463e-4f7b-8cfd-58856a42f52d", "comment": "Malware payload (Mirai)", "value": "c263b7dc3cfd3af8b6477daafa50b9ebe426a12c06664499e24c27ce8312e68bb443afa4205837c34a1ffa0c7eee3010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907740, "uuid": "03eddf1f-b848-4aad-9d9b-f4b67104b9c9", "value": "T1A7F3D648BB600FBBD85ADD3B42E84B09598C650736B83B7579B4E904FA0B54F0AE3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907740, "uuid": "1b2d97f3-b7f9-4846-997b-10b431b05a6f", "value": "1536:Ss5qBEeg+Ex26tr+A8uFa2FhU007lJ4GmaWPMDc+Oz4alboKJ0TWYk3Rb3AKXczh:SsnetT6tCA8uFhUJ4GSsUqKm8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765907740, "uuid": "d8c5815c-84a0-40e5-807e-ce12e98929ad", "value": 159588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765907740, "uuid": "60f2c3be-e501-43d4-884e-3faf8af35946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765907740, "uuid": "a2a7f242-6363-4e26-bbf7-9addc47678d6", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847ce7c8-da1a-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765846787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846787, "uuid": "0193c39c-c27b-480d-b623-690a2ae3007b", "comment": "Malware payload (QuasarRAT)", "value": "e52560fac0dcf3ec7a2b3ae70640bf46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846787, "uuid": "20b75782-8dce-4326-8866-fcb77aa6aa33", "comment": "Malware payload (QuasarRAT)", "value": "b3a5a493e978d7b6f039bf9f329eb8407aded8f0feef8796c3fbb01d135eab11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846787, "uuid": "67baba3e-139a-4213-bfcc-92138c337a17", "comment": "Malware payload (QuasarRAT)", "value": "a9d5cd9bf76c388d199be2b8c96291722cb0cd28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765846787, "uuid": "ea6aabe4-67a6-4cd1-97d6-7852bf0bcc8e", "comment": "Malware payload (QuasarRAT)", "value": "83af5277998459a71abf715d2f5a72e46a5aea923ea5cf187809727f0046eb3eeadf17c63bc0c33b6d4edc314e2944ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846787, "uuid": "63343855-2f79-4d38-a9b3-3a823766ffed", "value": "T181F53A043BF85E22E17AE27395B0042657F0EC1AB3E3EF1B1291767D2C63B54D9426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846787, "uuid": "afe9a106-66e1-4643-8612-a4ab88f8ab0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846787, "uuid": "3219e9b2-22ec-4c83-bb17-1e2dd0a1dae3", "value": "49152:ovYgo2QSaNpzyPllgamb0CZof/JRbxNESEok/ihLoGdNTHHB72eh2NT:ovJo2QSaNpzyPllgamYCZof/JhxTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765846787, "uuid": "a78af538-d1bb-4d47-a59a-8baeb230611d", "value": 3334144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765846787, "uuid": "d4d68765-ef46-4ada-93f8-9de4c46a21f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765846787, "uuid": "3c8aa0cb-5f55-4433-bc84-eab8e55d9a92", "value": "VisualCodeV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75191473-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765852774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852774, "uuid": "2cf63bcb-918c-45bd-acb0-4a46003590e2", "comment": "Malware payload (Gafgyt)", "value": "9afaa2ae5c47b302892fb89cf01e8ad3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852774, "uuid": "be391306-783b-4056-b6fb-c24d11a0afd3", "comment": "Malware payload (Gafgyt)", "value": "b46e9e9139a9318ae2e1ab03fb35c478b0a99ea27baacc8e6abdc23dc6085486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852774, "uuid": "5da65f96-f081-4d49-bfbe-751f5312f250", "comment": "Malware payload (Gafgyt)", "value": "41cc9cafe07459c8e37c913b296c58fa43ff993b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852774, "uuid": "a926b3e5-a1d2-4b29-abc0-9e3656c40902", "comment": "Malware payload (Gafgyt)", "value": "12336e5431822c5ea84f2808f708d84051d794c8aeb36e0ca11522f3b5f20a0879bbe7a90b106c6fe0af1437dba01463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852774, "uuid": "03e6ec3a-49da-48d7-ad57-0fccfa004e57", "value": "T133F33A09F6408B57C1D2277AEA8F424A33339B94A3D733155A38ABF43FC2B995D32915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852774, "uuid": "2be4a9b9-7cb0-4035-b33d-e2eefcb1214d", "value": "3072:Bi3eg/SaaOfhANbakAslko9unH5EM/9xEZcmgwZBxPQgVa:xg/SatfmNbaEp9unHqM/92cmgwZBxIgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852774, "uuid": "29548317-16ec-44bf-9cca-33527534ee79", "value": 161376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852774, "uuid": "e430e55f-5f2e-4363-9cd0-c856adadfd50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852774, "uuid": "6c2d027a-44fe-4152-9e9e-a5b43da01b7c", "value": "Fantazy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43bef40-da7f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765890219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890219, "uuid": "9b54b0fb-1144-469e-bda4-ff310ca679f2", "comment": "Malware payload", "value": "57d6928172b3a5a3273ed92905e3c2e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890219, "uuid": "0957fa1b-d3b4-41c9-ad6e-debb0fc792d5", "comment": "Malware payload", "value": "b470978163ab946eab5a157fbca460afbbfb2d8504188e77499f979e15467b98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890219, "uuid": "17c68a4d-41ed-4a1e-9877-2eee43d2a29e", "comment": "Malware payload", "value": "66283ceeae8d0bd25897350a3cd38d7c56ad56d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890219, "uuid": "d6509938-5b0f-4c56-b36c-6fa47f60b384", "comment": "Malware payload", "value": "ca25ad528c33dc3bfb261e0b225444d4e32e96d71276cda68ca3d0fe84686f0360f918a43e3b9d128197db35a48ad0a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890219, "uuid": "255ef708-39ee-4a7b-a512-73cecaf1b591", "value": "T121C3E6096F991FBBD857CC7785A40B1918DC640731B93B357A72E908FA0E25F0AE39B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890219, "uuid": "63943bf7-2c73-4bb2-bd1e-5865f10fd305", "value": "1536:VeI9rzrY7H8k9NSMC0VnHhgti1U20rRFc5dmRoZ88nF5:VeIVBkzSYJhmijX88nF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890219, "uuid": "842090f1-c84b-44e1-9872-09a8445da1ed", "value": 122012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890219, "uuid": "55d53b36-eb35-4a59-b599-eeb2647639f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890219, "uuid": "3123adbc-b47b-49d5-965f-df7e0e65f4b4", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6851eb2e-dad0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765924908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765924908, "uuid": "614885dd-1c97-4707-bd3e-e49ffa69b1d8", "comment": "Malware payload", "value": "114d6c2c19ada8791cb0fd2f8afeeed1", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765924908, "uuid": "af3c2c7a-a016-4a95-bf62-d5b55e44e8fb", "comment": "Malware payload", "value": "b487b9f38735317cf78b83ecd7114cb877d35faf112d0e9a9592001b96958d71", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765924908, "uuid": "60954086-d473-4324-a527-f0aef9f46b47", "comment": "Malware payload", "value": "49ab30aa86fcb4cfb0ce5468257f80d8f52ed2df", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765924908, "uuid": "091df2d6-8e1e-400a-a0ed-07b8b5122064", "comment": "Malware payload", "value": "3eaea40c02baa57bf638c5cd49f0a9921f2080325f03f9cf3e4b5deb3e1e5a59e9a45103a940c2ecff17a54a9763e677", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765924908, "uuid": "4a956a6d-d706-4bda-9aa4-e651a9ff0f56", "value": "T1F59522C1AEB064B7F0066AB981D72ABFB34D3E131CE15C8602947644DEB16C6CE7E359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765924908, "uuid": "70769496-de05-444d-a438-c6d027a861da", "value": "679877ea45ff38e48e48875d525bcbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765924908, "uuid": "8483c194-bc5e-4ffa-a3b0-e1c2d97da1c7", "value": "49152:PZjFOvsKKU0y9++fnGrUaOm9LlHhTmEUHJG:BlKTfhFkcjJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765924908, "uuid": "6b693b5d-f94d-440b-9b09-fde8fbcc3cd8", "value": 1974784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765924908, "uuid": "c1e76e2e-9ac6-4308-9a6b-a21db88d7e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765924908, "uuid": "14efd17c-7173-40a5-a28d-f38e96383243", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e959ea-da92-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765898465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898465, "uuid": "5aa4c065-a4c0-48e0-823b-cdf5ceb992b7", "comment": "Malware payload (CoinMiner)", "value": "3ba92e7872a90ccaa9db8b1a92388844", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898465, "uuid": "69999fd3-e7e3-46f6-8fcd-bf1f074de8de", "comment": "Malware payload (CoinMiner)", "value": "b4a5d4e6c06d4bb1f8412059f8c0c1bc30c3ec1d1b104936a33d28fc83a831c5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898465, "uuid": "19e5918e-1143-4d78-b8ed-5d42495de05e", "comment": "Malware payload (CoinMiner)", "value": "ad681ef369769c897410ffca52be7ae5d68f65e5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898465, "uuid": "b868da1b-d3d3-43a0-bfb8-714613e44c91", "comment": "Malware payload (CoinMiner)", "value": "63aee20cd573263279d8ad55c5a3e2718743a326edaff71e812a1fff2d0b19b6e44d1dcf254e0ad5a0a755488f3c1f52", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898465, "uuid": "5352f150-5a8a-452d-a3bd-dbb4f1ebec10", "value": "T1283733D2798AB22AED710A3D58383585463342C4E9A7E7BE179BDC3F0F56272243194F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898465, "uuid": "5f6887e1-ce17-4335-a301-82e3378ceeed", "value": "393216:08adR2pQ9l8VJtZqf3n5Jt2E1ynizyjbIFRCZpJKP1S11RB1/tWxTPm:3bbJDM5JtR1ynCF8wP1S1dxtsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765898465, "uuid": "1f59b448-bf52-4052-8e33-423b4269682f", "value": 23558144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765898465, "uuid": "97d13db4-7bae-4b01-829f-6b5d64cdbd8e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898465, "uuid": "19c503e0-4c17-4859-b64a-f698b22ecac5", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ab9636-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879771, "uuid": "928b4bb2-64fe-4fa7-ac88-f607cf84e53a", "comment": "Malware payload (Rhadamanthys)", "value": "499810cd3094970c273e4f8112b7f535", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879771, "uuid": "31c4f7f1-9162-4744-b0d6-47409a131893", "comment": "Malware payload (Rhadamanthys)", "value": "b4ac79991dacce2c6b9be1d78f0b37cd7e44721938082481c6ac4b26af0fd844", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879771, "uuid": "b95f5e56-10ee-4a62-b0e1-e71475ba255e", "comment": "Malware payload (Rhadamanthys)", "value": "8d5752b3197a8a74217a5a0d349f809278be49bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879771, "uuid": "357f1d15-fe63-4cc0-a0ba-a465f1f8362e", "comment": "Malware payload (Rhadamanthys)", "value": "ea90a3bb52f4d71b36f117f73cd7ba9173386376199c0dfbf9e05dc6280d773e11ada217757b79ac5ad56b68de2e300a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879771, "uuid": "72ab814b-37ee-4177-8f09-eef1382eef07", "value": "T1FA932B310E7B9CF0619371F60EDE2F94893DAA59B89944C64152F79303DA372BDA88C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879771, "uuid": "67863261-7792-4f75-9963-19002cfae278", "value": "1536:GDB7eKg20MF7TEa/+GCRF+a4AL+a/WyCd5nt9N0pNx7Hk0r9tO5rMsi4Fwv6cuUL:GDB7b01Rw36FgB6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879771, "uuid": "633444f6-0372-4fbf-a2d6-b34ebf447a2d", "value": 96225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879771, "uuid": "2fd30084-68c3-42b2-ab36-32c47ddbeb8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879771, "uuid": "b5005b82-ef1b-4ba3-bc70-c2f5a92a1b22", "value": "invoice-1637482117.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e525d7e-da90-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765897377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765897377, "uuid": "cecb7054-ad83-43ae-b35e-1b223349f85b", "comment": "Malware payload (SnakeKeylogger)", "value": "7719a816e335592ec49ef36cae120cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765897377, "uuid": "b99ab85c-4ca3-47a2-bc2b-d329aedd9269", "comment": "Malware payload (SnakeKeylogger)", "value": "b5112c581bb86bae70d86aa62b2897baf4d4718a737b1bdfef76a1f5d3cbc72d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765897377, "uuid": "5aa0f4da-ae93-4d7b-89fc-499ecb1966d7", "comment": "Malware payload (SnakeKeylogger)", "value": "a1bbc67eef0f8364c57f4c5fbafa4160390c01fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765897377, "uuid": "4e9d64f5-81ea-49db-91d2-eb8a043f3198", "comment": "Malware payload (SnakeKeylogger)", "value": "4354c13402f6ab22cc8b1fda015014f51e2389aedb9d2b4d59a3eccd99dc005691bc6379e707824488042bdc2897a959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765897377, "uuid": "473cda96-afff-48db-b175-a1a7441477a0", "value": "T1D5B4E0C03E396B12CDB156749165EDB883650E387011FEE35DDEAB9B37C9A50AE08F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765897377, "uuid": "39af61bb-a3bf-4d4a-84dc-e45dafd15ba4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765897377, "uuid": "5f45dd5b-9460-4c89-b77f-7ad3689a7a71", "value": "12288:S64LAlcyVkDttqrMeW7I3ge+8ms9w6lnMXmDef/L:RGyVS8MXI3b+85yiM2CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765897377, "uuid": "f6afbab0-c748-4adc-b1d9-080b11db36cb", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765897377, "uuid": "789453cb-dfa2-40d8-b7a7-977a9ca8d51d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765897377, "uuid": "e833f88a-0437-42a5-a1d5-6f8691d495a0", "value": "vessel information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e0ba50-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879812, "uuid": "b8efd761-0a04-4e33-9647-394d8e0f2aa4", "comment": "Malware payload (Rhadamanthys)", "value": "ca2a5991e9bf8dd54e0cb1c3eb33432e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879812, "uuid": "9bd0b679-b15d-4465-96f1-cef97611aafc", "comment": "Malware payload (Rhadamanthys)", "value": "b55805ad2514bdb8429c7ba00c4ece154527a0ed446fe6557b87700e4dc941bf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879812, "uuid": "8fd446db-d863-4f00-8322-e4738714c3c1", "comment": "Malware payload (Rhadamanthys)", "value": "c4a154ba0b69bb42e257704f72493993e6855781", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879812, "uuid": "61b058e2-ec7d-4f11-93b6-1478febc9c81", "comment": "Malware payload (Rhadamanthys)", "value": "a01f03bd76c39875c22f2b5a87c3962d963f78f556480b8155517c34103f80c661117aadfd8ea5ba208f36df5603be52", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879812, "uuid": "909be3e1-db53-4e43-a8bf-48093938169f", "value": "T174A31824383172F8113932F4AD55197D8A1E1529E92EE9B84E2FFBF181C8F8167166CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879812, "uuid": "ee0e3cd8-8f18-4b43-ae30-ae5df68ef17d", "value": "3072:GDB7b0oep5EWxd7v71et3u3KoLZcTHySpTQxDv17+F7HP6LlfBgNcbJUFDF+R8Y2:0b+jHR20wxLUCJTJWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879812, "uuid": "d4f3a905-05a1-4b2d-8978-743e26fdbcd9", "value": 100749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879812, "uuid": "912ac323-0092-4c5e-bb12-2e79c6972b36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879812, "uuid": "179d3dc8-98f1-4cb8-a51f-64ccf7d70b68", "value": "invoice-1637482117.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ba2e3b-da68-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765880422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880422, "uuid": "51c0da1d-3ecd-4137-86ae-a1f3050c7498", "comment": "Malware payload", "value": "0f0eaf5aa079fe0c72c031abb0586ba6", "object_relation": "md5", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880422, "uuid": "63cfc687-59c9-41d7-a2b7-149e3f36a9fc", "comment": "Malware payload", "value": "b6dfe2c2a889848d6a19fd3e23ec87161a50e5aa90dd4802d9a55263838c245c", "object_relation": "sha256", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880422, "uuid": "ce203efb-3fa8-48fa-87b0-57073337156c", "comment": "Malware payload", "value": "0b4771a6ae4c9c9f16789ce069c274bd4eb5bae5", "object_relation": "sha1", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880422, "uuid": "127c02b2-21e8-4c89-accc-b68efcaf8c19", "comment": "Malware payload", "value": "4eb81fb49ccb352a30a7bfd4abb21a101c61b604abbc807509f570d37070a178b429d7ff10c285f424ea2396ba1e4d70", "object_relation": "sha3-384", "Tag": [ { "name": "193-187-91-220", "colour": "#9C1036", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880422, "uuid": "1f4edf37-b2d3-48b3-9f11-cdcbd064f93b", "value": "T127B53375B993C5BC67137B034C357AB573B3019223F0A581822FEA768F886AE7C991D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880422, "uuid": "3fb82d6d-df59-4a4f-b5ed-136fa3d2f377", "value": "49152:3ZxhNznaSJvYXDd3MeLHvSgBmiBG+iXXoLYl91hQNIp:3VNzaSJQh3XLHKgBmL+4Xfxhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880422, "uuid": "2e217b36-5a45-4ca9-b7c4-26532ba3f525", "value": 2300704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880422, "uuid": "69ce9032-0ac0-4a04-a55a-11f9961f5708", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880422, "uuid": "2ae98f01-9156-41e5-9777-67a24a9ba147", "value": "b6dfe2c2a889848d6a19fd3e23ec87161a50e5aa90dd4802d9a55263838c245c.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebb661c-da4e-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1765869138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869138, "uuid": "0c9e7a09-c656-4777-a2cf-10f76bcfaaf2", "comment": "Malware payload (DonutLoader)", "value": "8c99148c6173a13860e41cb78ee92697", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869138, "uuid": "29bac6f6-9b4c-4352-b8c8-3369b71d9fb2", "comment": "Malware payload (DonutLoader)", "value": "b76287db4bfe144f654a0a2a5082cc500282309e40eb09f1b8b0139834b0da84", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869138, "uuid": "231149ef-2b78-4314-ae94-f2d4344f74b5", "comment": "Malware payload (DonutLoader)", "value": "15ae68fe001d2c871689b888b3c5be8db6488049", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869138, "uuid": "d2b8ec14-87a1-4c91-a569-cc5ad4ad2136", "comment": "Malware payload (DonutLoader)", "value": "47264aa126fa259cad8e97b16e084f3b31654443bad7592c9e1a8c392243ca8b4cd6df706218281be7eef44806acf8b1", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869138, "uuid": "2e872ef0-4ea8-48e5-9128-ead3ce248163", "value": "T1ACB57C4BBCE119FAC0ADA23088725195BB61BC452F3123D72E90B3782FB2BE09D75755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869138, "uuid": "8047a7c3-a11d-408f-9692-9792c12019df", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869138, "uuid": "60e95025-1767-46fb-a4d9-41b54bc1fc2c", "value": "24576:lGXSwzuMy8CZ/5DDgBxKZS4uW7VQ+A2ndWXA0GmcoeleTNj4HGu2+oc3rtSkgf:lGXRKMWZ/JD4wcmVQ+pWUmPJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765869138, "uuid": "3a0d2bde-e7e1-4eaf-8167-cd0d0fa576ec", "value": 2451456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765869138, "uuid": "6d34cbf7-e55e-495d-919b-61794a8c23d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869138, "uuid": "d55ab557-1c61-4390-9168-2fd3b166db2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7feab83c-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879421, "uuid": "089bec42-66b5-4353-9639-ddf3fd471219", "comment": "Malware payload (Rhadamanthys)", "value": "f66f4013ad0eecac7394fa0d81f2c66d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879421, "uuid": "ffeee73e-65aa-46c4-944e-4606b7bc1bfd", "comment": "Malware payload (Rhadamanthys)", "value": "b879baf9d29d29a35e2a6f475d3f266979fa80219ce47aeecf3a3af30ae16b51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879421, "uuid": "24218c94-9927-4419-a366-861df31c9298", "comment": "Malware payload (Rhadamanthys)", "value": "fdda51b88629f1558aabe4a77768fde3a1c0f55c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879421, "uuid": "fd2538d7-779e-435e-8ce7-321a30638ef8", "comment": "Malware payload (Rhadamanthys)", "value": "86488419c4dc66d9893628e0901247dceaf5c983b098127d448a4bf77258b233ebca0fb025b9cb9ce627b7701e189f96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879421, "uuid": "ca94a5aa-0945-4ae1-8db0-c8a3816ac736", "value": "T175A32A40B9A2F874004495323AC494F61E29D582DD3D098BAB2FB381F159F5AEBEF5D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879421, "uuid": "64a1b437-2c90-49a4-b20c-c520d5569bb4", "value": "1536:GDB7eKg20WPu7TDjC3HBd+TNTw2cX8yj+sj/73Vvqg29qYDiXuy1erkh5cvrf6kR:GDB7b0vLXi84R6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879421, "uuid": "83c523fc-a42f-4ee9-b5d7-8229a6d16fda", "value": 102047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879421, "uuid": "4f9ee78b-752c-488e-a3e6-9c2997dad4d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879421, "uuid": "ee192491-c683-41df-8dea-be3713e22f24", "value": "invoice-1637482117.pdf (98).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1aaf6d-da53-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765871093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871093, "uuid": "8d3d7a75-256f-4731-942a-4bc8e929cb03", "comment": "Malware payload (Mirai)", "value": "3a5432ed3b36de906da151e80636ba8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871093, "uuid": "1ef1bb3b-bbcd-4961-8105-57435bddb3f4", "comment": "Malware payload (Mirai)", "value": "b8acdd5d254393e9ecf6913e0fddddaedd420ffb7a35e4a6505c8d749395c3a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871093, "uuid": "72e7941a-5b3d-4415-8f4a-4b1d00904606", "comment": "Malware payload (Mirai)", "value": "aeadc185718ba136b4af97743a0bc19b3140f07d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871093, "uuid": "fb51d17d-c6e5-45df-b365-142ea30d7394", "comment": "Malware payload (Mirai)", "value": "aaa5d1fabcc0455e5029711045b403bb11eb69bce35c2ec08c236626ee1222188a25a8434666116295894801a25c63dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871093, "uuid": "6e230312-27ea-43cd-8880-df8714f87fd7", "value": "T110C31A45FC415B23C6D212B7FB5E428D3B2A17A8D3EE72039D256F60378B95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871093, "uuid": "f04ef00c-c168-42e3-9dfb-9f404e8c1a9e", "value": "1536:JUvvsE3G5qB/RpF8/zYY1XANIK4V02RTV5V/1yHCxejpChaDklk2wyw8FLRXJ4mF:qvvTQOFoZ1X44DRR5V/1yWApCoygb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765871093, "uuid": "dfe2e36d-0b3a-4d51-922b-c38569c66527", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765871093, "uuid": "c70c5130-447c-4c0b-a6b7-7834f6ad1089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871093, "uuid": "1ba7edb1-935c-4489-9b78-aa2d7d3f621f", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77be382a-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765852779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852779, "uuid": "31d81303-b924-42ed-8547-c73c52c51ef8", "comment": "Malware payload (Gafgyt)", "value": "8a7693c4142fbea243a3ecfb17f74fa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852779, "uuid": "44c70477-e7c1-41e8-8700-e728a25107b9", "comment": "Malware payload (Gafgyt)", "value": "b977fd0c54594ba80260db9497f50c97c88f0057792f9de545aa77d01e18598b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852779, "uuid": "02f7d185-d8a1-4e53-b5a5-80f1e2375dd2", "comment": "Malware payload (Gafgyt)", "value": "46574755534aa34aba72c3eb2a07533063392721", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852779, "uuid": "f8163396-f4bf-4119-88d9-533f8479801e", "comment": "Malware payload (Gafgyt)", "value": "74c7c0c519abc5f01b2601ac497d2fca3e224048963cba5260910b014617ea702a9d55348aab2704912176e98ca8f919", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852779, "uuid": "df5ca889-ed37-4b13-b88c-c12cc36d3554", "value": "T1D5932A47E9615BB7C0C66AB169E68D310713B9912F4F1B89713CA6F8074B8CDBC0EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852779, "uuid": "b679aba6-5fac-4a1b-9481-ac2b4dfdbcd6", "value": "1536:4TathcyY/axr6BrVtJtpGxgdKX+W3x8p0CvuzccmknVMOMuIfaW7:4aLdY/ax2BrVtPp8Xo0hZmknVMOtIfau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852779, "uuid": "bba37112-5569-4cda-9d48-b5c4b18f8cdb", "value": 89186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852779, "uuid": "cb1bdee3-6a84-466a-9692-8e9d033dff2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852779, "uuid": "ef5c2c2a-57e9-4d9b-813f-5ac5c2b75caf", "value": "Fantazy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c68542a-dad3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926284, "uuid": "36a1a1a2-61db-4935-b652-da1521b40b3d", "comment": "Malware payload (Mirai)", "value": "b5aa6feccfcb0de4afc127de10ac44fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926284, "uuid": "21242375-f887-4d21-8f9e-9b1e46cfc7b5", "comment": "Malware payload (Mirai)", "value": "ba0f8141a28b91a120bb160b9d16f3d360f49a60562c594836f21bdf7bfc455f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926284, "uuid": "565331b0-a510-4fe7-a936-f437f683fdc2", "comment": "Malware payload (Mirai)", "value": "d1724b8fddb6a30fcbef86ff3133110d730a7528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926284, "uuid": "2539fd6e-0fcd-4e4c-b1e9-86ff51331f77", "comment": "Malware payload (Mirai)", "value": "0a827b1b691dff951ca69aa93bcc97abcd7c7582726e459fff44e13188c13c0e97d91e47ce0755ef81b458d4409d3ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926284, "uuid": "0b744e0e-98c0-4424-a614-4c63483bca2e", "value": "T166E3B5096B612FBBD85ACD3741F84B0A189D654236BC3B753E70EA18F61A14F1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926284, "uuid": "54acafe6-a810-4c28-b342-c0f5b941f3c8", "value": "1536:R8HspBip1M4r/mSN/zoU8piZP02ONo2iSHq45OJnMuMFRtzxpit4Bx4Z1YkhLhCX:R8EOM6/jN85oxLH4XhTkxw8n1z50ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926284, "uuid": "b53f9e2b-a366-4903-a6d9-bbe46f85b7c7", "value": 155528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926284, "uuid": "f6410b8e-e72c-4f0c-8d9e-d6cf58c54af6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926284, "uuid": "45506e3d-6adc-469c-be0a-4b6abdc002e5", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5325aa-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879848, "uuid": "e99c3562-ff97-44df-9a6b-d475bffd52fb", "comment": "Malware payload (Rhadamanthys)", "value": "05a8cf3b58d6f1ccd7d6ab2035a3f351", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879848, "uuid": "5b8b56bb-5590-4bdc-97e0-2de0643155cc", "comment": "Malware payload (Rhadamanthys)", "value": "ba2c8a3e9f69216562bebf715c4eb9f656bb630b5a2fc4eb11de33372cae51b7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879848, "uuid": "ab7aa3d7-2ead-46c3-a49f-d256fd24e6cf", "comment": "Malware payload (Rhadamanthys)", "value": "a3948fcef6e70eb6a7f5196d4dbbee5cb4a1fd66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879848, "uuid": "3131f414-2960-4a0c-9919-d5ccadf5ce26", "comment": "Malware payload (Rhadamanthys)", "value": "f3a8e6912ca50a437e6ebf439a97c27603467a515d6275c65baa6f64a1242f7707061de665d61ca8bdc344311949ea1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879848, "uuid": "543c5b38-f53f-43af-9600-16294b929787", "value": "T17D93FB54B91A7EFA08E13CF5ACDA51B1EF0F988941818828CD4FF23164E1D1E8DDA5DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879848, "uuid": "e3d2db34-5787-4c51-b3f6-d517c57e67af", "value": "1536:GDB7eKg205AQbLsgecYuatxeF7v0qzowqSSuMo5egIVCKVpJAlqlVlvrVlLlUlfV:GDB7b06UHl0wu6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879848, "uuid": "b8c2fdd6-355b-4a18-8324-62d8e468f41e", "value": 94218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879848, "uuid": "edbdeea7-b96c-40f0-9b2f-f4b5482a0883", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879848, "uuid": "20680d83-4902-44b4-854e-165ca120dabe", "value": "invoice-1637482117.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab8b3ef-da80-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765890579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890579, "uuid": "9b0cf3ce-ac8d-4ccd-ab3b-25f2f5e34a43", "comment": "Malware payload (AgentTesla)", "value": "a4f3e1b972a24096831a793c232f90d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890579, "uuid": "1f444c28-c83f-4f15-b30c-dd14f0ced170", "comment": "Malware payload (AgentTesla)", "value": "ba87bd0148ff07519450a44baad09298ab80541eb52c1ed3bfbd3854d74af4fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890579, "uuid": "494ae7bd-8cfa-4de1-b818-bc3aeedb9df3", "comment": "Malware payload (AgentTesla)", "value": "d374686c42831142138def23202ad587e5543015", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890579, "uuid": "b598d617-4495-4e0d-8ebd-bd2067803a60", "comment": "Malware payload (AgentTesla)", "value": "93fb97277c54849bb434ea2aed2497c807eaae3a0abe2b06cf3cd4be6ba9a6bb4f45e694d77690ca30ae99de4a40cc61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890579, "uuid": "8ccdf7aa-e572-4908-893f-2981786c7fca", "value": "T1FA1533ED44D3D81783A72D8DFFCA5247B1B97532F4AD6E0144E5B8A86F63A4B11248F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890579, "uuid": "13a0f3b7-d04b-407e-ab78-d860200c816a", "value": "24576:NA7YsJ+YTt9P3HiWERDH6QXlieDaRsuGZl:NAEsJ+YTtdShH3lieO2uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890579, "uuid": "a51828d6-2a44-49d3-a37d-f22ced7f8d9f", "value": 885322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890579, "uuid": "423c14b3-d44b-4ba3-bfaa-6f7761c393d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890579, "uuid": "4ad078cb-fbc6-4da4-8940-4988a396a033", "value": "Prova di pagamento bancario.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24acd0c6-da70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883563, "uuid": "08436ecf-ae9b-4884-bf6e-cd4cb1f682aa", "comment": "Malware payload (Mirai)", "value": "8e1bed276797422a9886b84a49a65d4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883563, "uuid": "26083786-e772-401c-8c05-4de241ef9849", "comment": "Malware payload (Mirai)", "value": "ba9abc8202c6b69858b6228d7728b6a3e2d57fdd8bf248568c1de1173e70eef1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883563, "uuid": "412c5a58-c5c5-488c-9bbf-777de10ec9ce", "comment": "Malware payload (Mirai)", "value": "f1e817d635990d9134a10175761bf59aacd736a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883563, "uuid": "f797840c-c88f-4455-901c-44ea4ee13207", "comment": "Malware payload (Mirai)", "value": "51fb58898a8d460cb9f4c7063b284f919890a6ceba8e8b540bf78ba7884456068eb7a2112a9e01f1d76819445f676f98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883563, "uuid": "c0ab90e4-aaf1-4e42-9a09-706e64aec7c2", "value": "T1AAB38D2181148EE8E1AE4975B550657C9323B411725B2DBEDFF484B0C087F9AF28F3EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883563, "uuid": "5408d7be-4d33-4763-a5f4-e316707d5348", "value": "1536:23QSJXUC3ZdN9y6g6gAStdPjBHuDl8d8ULgz1CBgJijVCg8VRBVP:235Uyh46g6gAStdPo2Lgz1cKYCgKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883563, "uuid": "5e3abb1a-b18f-4ab5-a972-ae153da91b54", "value": 107976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883563, "uuid": "785482dc-23e5-42bd-a4fa-e4665c1f25fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883563, "uuid": "0f444209-210d-43cf-bc1b-8664664faa14", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81634b5c-dad7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927957, "uuid": "764ca01a-b834-48bf-b1c9-a5f15b7fb080", "comment": "Malware payload (Mirai)", "value": "412bd7b4bd98c2781995e153c1f018bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927957, "uuid": "edfef4ee-6868-4b2b-b6f5-0bc3514a4070", "comment": "Malware payload (Mirai)", "value": "ba9f14c860bdab87eed1e4ea32d73849036473d4414d3436c731f2e09e23e22b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927957, "uuid": "f64e4840-db62-4be0-825e-ca276eb1a3dc", "comment": "Malware payload (Mirai)", "value": "5a29fe98cac199d6e058a640b0e6be24371956aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927957, "uuid": "ead647f1-6549-488c-a672-f21e1df1996d", "comment": "Malware payload (Mirai)", "value": "a1e3177b342a3bc50aa6344cc2901539b978fb02d6f6caf8b89dde84c2376b9157fb420d0350e600219dbb5d1fa1383b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927957, "uuid": "669522a4-2cf4-48af-900d-5809f0c81ab9", "value": "T12AE3B40F9FA09F7EF2AC837587B74F259A5412926AF1C5A0E12CED105E7434CA42FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927957, "uuid": "ec42fb25-29bc-4d72-99d0-9ef9a76ffc52", "value": "3072:SUxfI/PBIWcDWnKZ3xGVxlEuBMl4xJh0PjWuEiV93ycZcatQryhCbwOKkMaoqAnD:Sqw/PBuoFXxbwkUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927957, "uuid": "4403a95a-f979-4927-95e8-89ad9c4a726c", "value": 151432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927957, "uuid": "71d28a2c-150d-44f3-8e7d-860203f7ad32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927957, "uuid": "c3ea927f-3292-498c-90a4-a266fcc3f038", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef50c85e-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879608, "uuid": "d4f3b265-cf73-4c9a-ad64-c6a7b510d499", "comment": "Malware payload (Rhadamanthys)", "value": "06fa0fed02dc869337ea3e2b30c631ec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879608, "uuid": "378f0964-bf02-4809-ac12-ea77eaf6a3dc", "comment": "Malware payload (Rhadamanthys)", "value": "bb544dd651c72ef15ab7ad141ffc173163be191065c06180e130b7f3ee482e81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879608, "uuid": "92486a7b-5f91-4ccd-b943-ae6187b07915", "comment": "Malware payload (Rhadamanthys)", "value": "02f8aed60c37082da81dc2cbe9059eb75a8b7350", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879608, "uuid": "3b07d373-7baf-419b-9814-e0eda5a9ed21", "comment": "Malware payload (Rhadamanthys)", "value": "9cd9c99c282c54ebd6e2ddaeb7cbecab13196bf2fc32e2073f082e7f27e64bc2d976c452728e04af4e32bc53899739f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879608, "uuid": "63baa2c0-56f2-4894-be94-91cc9b549760", "value": "T1D6A32A482F92DC55C2AEB2C86FAED6F0A48C4A19164E314C37FEB70A1467E61181D4FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879608, "uuid": "f9e5001d-5635-4af7-8c63-7f6c4ee48ab4", "value": "768:GDhd0i7J4sYKgY/CMNfWd05OYb6dwLwWykN2bHeVlh2P0DHRquZGRNGSJf8RryHr:GDB7eKg20hr3r2ZKavAFZg6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879608, "uuid": "c9c0f1d8-166c-4e6a-830b-e995c046827c", "value": 101360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879608, "uuid": "db17f47c-5c79-4ba3-86a4-a842afbdc34c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879608, "uuid": "67f87cfc-23dc-4df4-8806-fa69c609db9d", "value": "invoice-1637482117.pdf (68).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3ba0ed-da53-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765871150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871150, "uuid": "8a558baa-edbf-4b2e-9ea1-46cb7e4f0420", "comment": "Malware payload", "value": "78b1a95c1e0c29d649e8c298e160c41e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871150, "uuid": "2fac3b8c-ab59-487a-8f42-fca978ead1a8", "comment": "Malware payload", "value": "bca8f4ee974779a50bf6e5e3971ad3a4224c8e2a37d6eba5bfe3ee8c4380a888", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871150, "uuid": "867bafb1-b15d-4c7b-ae61-c9ff73cbb5aa", "comment": "Malware payload", "value": "8dc34fdf831fe155ad5c288e0ac82794820c2801", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871150, "uuid": "f7803d42-82c8-45cb-9f55-f9b2e42f8f32", "comment": "Malware payload", "value": "8448a40656c187ad1a528fb1dc25d4c0175fc562927a2cbc92e141e58382870a97359063ad65335c0738d1e3c4e7c807", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871150, "uuid": "6bfb42a5-c0d1-4fa2-8418-f47bbb0085f0", "value": "T15218BF46B34A88AAECD664B8D50B56B1AA307C444362A0DF7E06E7807D773E56F7D3C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871150, "uuid": "ad1de4b9-df23-4df8-bdcb-15512b14b123", "value": "786432:W9Z2wtPD0fTTmxTXe4zfkiDW4KTeFfVZVoYo:Wv2tmNlzfkiDW5TeFfVZVNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765871150, "uuid": "6b1e908f-54cd-481f-aedc-4543bfa4c054", "value": 90792277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765871150, "uuid": "d84946f8-0704-4267-b62e-832f9ff73884", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871150, "uuid": "de4a2857-ce26-4b79-9e36-2f2fde4d841f", "value": "myan77.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2237afc2-da84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765892149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892149, "uuid": "2ba7eeb2-bc1d-4640-9352-212a755c377b", "comment": "Malware payload (Mirai)", "value": "ee6a14b734f18177fff31a695018e816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892149, "uuid": "b57dbcfe-ca71-4964-ab2a-19bb76eb8f45", "comment": "Malware payload (Mirai)", "value": "be7475b704044ee3386380749b50147d1443064f3fca7f4fd09b5cff8fffe932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892149, "uuid": "891ef590-fd8c-4728-b987-4651326c78f1", "comment": "Malware payload (Mirai)", "value": "8d8d36d6f88317ec6bcdc1b9f8f4f096019c8758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892149, "uuid": "e92d9e8f-8e92-4860-bd88-52a760f5857b", "comment": "Malware payload (Mirai)", "value": "ce59696724249a691883999cdda04c4cb3d20b519aa68126f3538430569d23ec3c8259babda8732725019626db768ab3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892149, "uuid": "25d2c115-3f59-4b25-83ae-1776e104bd32", "value": "T1F6346DCBF801DD7DF80AE67B48670909F530B7A111931B3A6297FDA7DD3509A0923E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892149, "uuid": "11aeed62-b63a-4ee6-963a-20d8e5f96c07", "value": "6144:v3ZWhqlq8B5FJMyw15wvHxM1soxzTL4Zqv:P/bxWsfqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892149, "uuid": "53f9aeef-4911-4862-9e47-591a031b7978", "value": 244872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892149, "uuid": "08f3ee6b-5d56-48e9-b3a4-7d825b502f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892149, "uuid": "280c3473-bfaf-4f17-949e-cc66b8165dd4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c9070d-da78-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765887028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887028, "uuid": "66e32cd1-9e7f-4e6b-bf97-c46c8a1d511e", "comment": "Malware payload", "value": "db3c378e4c58e68c6b6a831bb1d26a94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent.MTB", "colour": "#E3C64D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MTB", "colour": "#24D24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887028, "uuid": "d91ec88a-a137-4049-8ecf-8b114db5d2a6", "comment": "Malware payload", "value": "be8b9a0e30398197d58d21c32a0980553ac2b523ae8b2219f748b4411bdb4170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent.MTB", "colour": "#E3C64D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MTB", "colour": "#24D24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887028, "uuid": "66cd1dde-8257-4c4d-8acf-a0399c8ad09f", "comment": "Malware payload", "value": "d86e70b2dee5f5b14d5aa988c2753b5dbc2c8218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent.MTB", "colour": "#E3C64D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MTB", "colour": "#24D24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887028, "uuid": "1c2fbec5-b015-4288-967d-130dc4a204f2", "comment": "Malware payload", "value": "9f016ffc3038e3a18a0d7883587a96aff2771953c18864fcf6ea4b5c86bd566e3ab94bea8a2e54eb29697c4821c4394f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent.MTB", "colour": "#E3C64D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MTB", "colour": "#24D24A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887028, "uuid": "938f100c-9944-4c57-af4b-0d9f180c2fac", "value": "T12E45CF11B2818039F4B3057349BE8A6A952DBE31071598E7B3CC565A1FB9AF13D32B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887028, "uuid": "3767dbed-23e3-4bd2-91d0-92d919004e8a", "value": "3427ae4321397b53387ce371d24c70f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887028, "uuid": "7234196d-4772-44e3-94b8-316fc0823b72", "value": "24576:CZiQqq9tloleREJPAFE/TPNVPB1szDG/CRkXyv/C2DpXDRz13vv:CZiQqqjqJpTFVPJ/Wv/CWXDRtvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765887028, "uuid": "04b57522-8e3a-462e-93e5-0f18514b7479", "value": 1258616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765887028, "uuid": "6fcf5e74-fe98-4edf-8223-f68ec636e4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887028, "uuid": "fd700db5-89dd-4be5-ba14-21d488dadb21", "value": "pvzupdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b5efae-da50-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1765869878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869878, "uuid": "0f7dbfba-cb28-4886-811d-81d4523bb31a", "comment": "Malware payload (DCRat)", "value": "5fe7351c52023dbdeef76b2a73cb7f92", "object_relation": "md5", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869878, "uuid": "c5e4faa4-bef9-409f-9780-09854587259a", "comment": "Malware payload (DCRat)", "value": "bf374d8e2a37ff28b4dc9338b45bbf396b8bf088449d05f00aba3c39c54a3731", "object_relation": "sha256", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869878, "uuid": "b18e7da4-9a65-493c-b0d3-77ee8fe84d49", "comment": "Malware payload (DCRat)", "value": "dabfe3aaee2645df3e30f85930afe88b9b43e9d1", "object_relation": "sha1", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869878, "uuid": "68475084-a284-4ecc-814b-403cc8e7dea0", "comment": "Malware payload (DCRat)", "value": "c08aa34bffa5783fbbc3f31ef232b6730452c199fb065c87073ad18c15129fc3b514912ca375d01d73fac20b4b76811e", "object_relation": "sha3-384", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869878, "uuid": "fd8d4c2a-a934-4810-9d6e-903585bbf2f9", "value": "T1A475122823D95B44F5FF5FB43864505146B5B701EC17CB9DB2C0618C8AB7B8AE732AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869878, "uuid": "e33f2141-849e-4e65-9e63-f37376bcfc7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869878, "uuid": "760d56e1-c22d-4ef8-bf1e-4358480189dd", "value": "24576:6w+JEfJhZ8j53sY1jCeqm6qv80MaooQajSMpHYWOkEfW5EQJZrUVvsgMYHQgdUU6:7+a5csqCeq08moPajSQY5HYryHACW8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765869878, "uuid": "9324675f-b431-4f3a-9b28-c660619b4e34", "value": 1561088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765869878, "uuid": "424d26a0-4f97-40e6-8831-f6331f627ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869878, "uuid": "f4f397f8-de69-47ae-bc88-b3409ae9246d", "value": "staxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583fa0cd-da6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765881502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881502, "uuid": "f341e1eb-7862-4570-aa7d-fc28ac5135c0", "comment": "Malware payload", "value": "d74bee5b0023115a134f7c8a676cac45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881502, "uuid": "b2135d00-028b-4f5a-a3e0-c8bf4f487bca", "comment": "Malware payload", "value": "bf4f356b45ca7b7bef77f2c047d0cdd97103ad84b5ace112465871ae92f6cd2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881502, "uuid": "c0dbe3c5-10b3-423a-a458-c71f2491e50e", "comment": "Malware payload", "value": "62e7648c4b6377e7e3b0253b685128439b32d8f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881502, "uuid": "15cc79c5-1064-4ee6-a2eb-aa2ce9b68b6d", "comment": "Malware payload", "value": "0c0b27abe46c23ebf8d369496f65efbe467c45ad2d6ae2ca00c8d522d4f7703a662dcf061f6bd718175bbd0d1ac79de1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881502, "uuid": "42ffe7c4-1482-4272-951c-58496f73ae0b", "value": "T1D3644B28739D0A26C37FA778C4A60540C7749A27A66EEB4E785C70EC4FB33109693767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881502, "uuid": "e13a7a61-ab0d-43aa-bbc1-a3e99e30e915", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881502, "uuid": "8a5605fa-ced6-42c4-b620-468449b686d3", "value": "6144:R25EJF6VcFKRxwy3KvM24Tns7KXtIGruMsjF7Nzphrs03LeaEa:R25EJFPM2nitdgjF7jhrscEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881502, "uuid": "e5044824-7276-4643-861a-3d73f251833e", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881502, "uuid": "906491ff-0d6f-4d8f-bd38-4ef24b67bb48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881502, "uuid": "4e95de2f-662d-4984-8db2-e217804d3d96", "value": "cdn-10049480.file.myqcloud.com_1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946dee40-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879456, "uuid": "356a5ad6-3136-412e-8fb2-ef773521e9ff", "comment": "Malware payload (Rhadamanthys)", "value": "8f5093455200f1e24f6a9b35c0a134ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879456, "uuid": "3728e64a-c6f2-4316-94f1-859bee9fd0c8", "comment": "Malware payload (Rhadamanthys)", "value": "bf8553ff2ba500831f5d0787fec39bd59113a80ba04be8c6c09d6e960fc7934f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879456, "uuid": "998bc641-0b26-4ba0-afc2-c04d753535cd", "comment": "Malware payload (Rhadamanthys)", "value": "ae32c97ed2b3f3803864b58666fc76ff7f2def3b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879456, "uuid": "d9edbc14-3ffe-45a2-8cda-9c49a6c39aa7", "comment": "Malware payload (Rhadamanthys)", "value": "3238276400e0ea750fc4492ea76fc90dc249a2b95efdbe550660e8dc326366f8f556bee30a01af3f63345d7b55514b14", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879456, "uuid": "1839ee87-0277-4200-8c8b-6d39654be31b", "value": "T1C3A31B8E1FA2B8E115D260854CD321F2D84CE9DA8353376928BEF631163AB156D439FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879456, "uuid": "15aa3c48-7024-4b16-85cf-8a1957d46b5e", "value": "768:GDhd0i7J4sYKgY/CMNfWdqrXnTr94TkHbu3A/Uylq9hVSLAuAAroQW+FF+Ec+0FY:GDB7eKg20qrDr94TWyA/JA6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879456, "uuid": "2b18eb9a-305c-4dbf-b213-5e13cb7d9a7e", "value": 98830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879456, "uuid": "bbaa9523-802c-4d9b-9473-54d4635d0c56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879456, "uuid": "7ead7082-27a0-4142-8a65-e1fa9cd9a345", "value": "invoice-1637482117.pdf (92).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53564ee-da86-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765893362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893362, "uuid": "cbdc7895-5fc2-460b-a3bc-707aac7eb897", "comment": "Malware payload (Mirai)", "value": "f57e378941350c5af9a55befc90f8b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893362, "uuid": "a086dec2-1f11-4634-aa43-aea0d70870cc", "comment": "Malware payload (Mirai)", "value": "c1519501aa51e501f3b852b1e3377d907e90b2d788dbb3781ff06d1975ece90a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893362, "uuid": "a7b961a1-415c-41b1-a8d6-ebc8b70b7da3", "comment": "Malware payload (Mirai)", "value": "12ea09b5061795314a61e6901bdafed8d44ce0ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893362, "uuid": "ac2cdfdc-3351-451c-8c9c-9654b9725042", "comment": "Malware payload (Mirai)", "value": "b27a09cad369d87a66f71c93cc997da665d27fd30cb689d68f17bdc0d610da62d5aa37f1e0d25da3358ce5121c42d9d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893362, "uuid": "dc7e563b-ece2-4a08-9d32-12eb307c07c4", "value": "T184B32A86A3194303E1434FB6BE3E27ECDFADA95091B8BB4C261B760C4576C364447EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893362, "uuid": "60ed42cd-7279-4f13-bfc0-9acd7193bb11", "value": "1536:ePSWf5zhkmyYYA8RhLwXYeUtdJSgeJyIyoD4u8nTo5S:lK51IhLwI9SgAI+8n85S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765893362, "uuid": "77dedf41-1ced-407b-ad46-2920a5aa68b0", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765893362, "uuid": "4ac1b18a-75b1-4ba3-b685-946e537e9b9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893362, "uuid": "eb5c7637-0e64-44d0-af7e-675a4bd2d6d3", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c3cb98-da48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765866705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866705, "uuid": "5c54d7b1-2897-4682-b511-d0b215f92d2a", "comment": "Malware payload (Mirai)", "value": "ff550536eaa06ac8d77b7f8f7ffe10a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866705, "uuid": "5d260cc4-f252-4f95-ba3b-b2a7bd190594", "comment": "Malware payload (Mirai)", "value": "c1a8791c0f603bef9ad81abd6abf3df6951210dcf0b5164a8e67f82f9fb4f332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866705, "uuid": "47387fce-9c64-4619-92f1-bc8d499fcf6d", "comment": "Malware payload (Mirai)", "value": "c2e48efccddbadd2e1643ef7ac7bed4f1f96fea2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765866705, "uuid": "d8888f06-a1f9-4ffa-b07d-36de1d301000", "comment": "Malware payload (Mirai)", "value": "3c15351e9e35d386f61f7785ac4675f8252ac929099962a6c6cbf8d0a8f2aec2d5872ca30fd62ca6f38c55fc016b4a30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866705, "uuid": "9f7f767e-2f3f-4f4f-8067-7466a0788c1d", "value": "T164D33A17B5C180FDC4DAC5B44F9EF53ADD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866705, "uuid": "ce0ab713-3683-4176-9c82-d4deab0b4bf7", "value": "3072:tGtwnNiaOnUToFiPT9OSQ7AOaogjV2iZlBWCgaiAXQPdL:tGtwnNiaOnUTquLyCXQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765866705, "uuid": "6ecb9972-ee70-4b98-b510-f3689fa1952b", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765866705, "uuid": "7b4a2c5f-c44e-4f6c-81aa-ed802c6c8fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765866705, "uuid": "83215488-fefe-4707-8df3-cb8e8f80aede", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09da3064-da65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765878794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878794, "uuid": "8869d92d-ead4-49ae-9cb1-8bf9687b79f2", "comment": "Malware payload", "value": "126649f210daf0b2e28474e2140c0432", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878794, "uuid": "1dd2cbbc-3349-4f56-b10e-9531a8c946ba", "comment": "Malware payload", "value": "c1afe825d95dc0fa7f72ffd7c7a57faa7ba58d66bf21442d5f92fcf6114cb735", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878794, "uuid": "147ccf56-cc8b-4acc-8453-a7a2594c598d", "comment": "Malware payload", "value": "3ab9b505c6d403082e543acc01f26d1fab50cde1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878794, "uuid": "b1b4a1bf-ed9e-427f-9cdb-21de72a4042e", "comment": "Malware payload", "value": "313c5ad2a7523fe994d8c652e4eae4d93a6eeec659331a61a664aef9c06eb40fd03011c64dbec1e1235fc98f5b9288e2", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878794, "uuid": "759fb0ea-160e-44e1-807b-8692569f6e35", "value": "T18B95CF13B2CBE03EE05D0B3B05B2F17454FB6E616523AE5296E48CAEEF250601D3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878794, "uuid": "68b32536-a734-4d6b-a713-3869a0599525", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878794, "uuid": "d0654e8b-bd2a-485a-9a1f-9e317a4e4703", "value": "24576:MawwKusHwEwSDMnoQCIWNRrwpLajs0Ejq4BbUSxfafBGYpqMM3IC:swREDDMqNRruLa1ErbUQ8P054C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765878794, "uuid": "e7a59e1d-04f6-49e8-b5f0-2550c9588b11", "value": 1933860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765878794, "uuid": "37f7e941-73c6-4291-800f-542279d9dfed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878794, "uuid": "f2d487d9-4e8d-498d-aee6-fe0cf52d586e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1322d94-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905300, "uuid": "4fac47f9-299a-4d84-9075-e16afcf2938d", "comment": "Malware payload (Mirai)", "value": "a6af88a5174cdc0887a00ae94c6fa17e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905300, "uuid": "805c6162-2856-4472-b20e-28d8aaf7dbdf", "comment": "Malware payload (Mirai)", "value": "c1fce75dce50f88fe0e2e261b69532964219cf990155cb96d9dec9aa4e6e1e51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905300, "uuid": "ad01ab3b-a6de-455e-9209-b8aaf1860bd1", "comment": "Malware payload (Mirai)", "value": "7d2e11369c8764db923e119b1d9b6a9f787c5deb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905300, "uuid": "025bac60-12ec-4cb7-822d-d3bd8020fd4b", "comment": "Malware payload (Mirai)", "value": "9b1f0a319a8ed652c2fe389d9deeb8c84524a217181460dc913ba3dd016af443f851722fa8ca64bcb52e84be1e873daf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905300, "uuid": "2607cb57-4340-4611-bef1-7b968709012a", "value": "T139D30865AC408B25C9D763BBFE8F618D331313A8E3EA7026EC141B5577DB11B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905300, "uuid": "9c43924a-858d-4a3b-84e2-d66b7622ba54", "value": "3072:b3AOdKbLPmp37Pgn553DP3fuOIqT9kGki+b5gcVnp5:b3rdKvPmp3e5ZDffuOIqTCGki65N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905300, "uuid": "eaeab038-abb1-4293-aea5-948ad53f3c0c", "value": 141008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905300, "uuid": "6fc3b570-4c01-41a7-95a3-1d5df86cbb8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905300, "uuid": "1ebf9fcb-132e-4bcb-adb7-86beee4f241e", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c062a1-da86-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765893359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893359, "uuid": "7ddcf254-9966-4de8-a914-3801c8dc2c09", "comment": "Malware payload (Mirai)", "value": "35cc40717341152051210d6c5bb62959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893359, "uuid": "6ccbe997-9a60-4ebf-aecb-223c3d4e442e", "comment": "Malware payload (Mirai)", "value": "c23c2e74869867c9762b56c0656d5dd3edf73fbeeb8462e38384d12cedee5d75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893359, "uuid": "8bc26a3c-7e0f-42c3-99fe-7185736f39b5", "comment": "Malware payload (Mirai)", "value": "aa2cbdef5936269c916107550b8cbf6303a4dcb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893359, "uuid": "69c173cd-6159-4342-b0f8-c8903fd13719", "comment": "Malware payload (Mirai)", "value": "6aae01dfc9e3e271def089d998779ef5ea9c79ad27025a90b3131df8ffd05675025c0116be101ca166c1f52d9fc968d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893359, "uuid": "ac715f40-873c-4ae4-95ca-784a9ac4c49d", "value": "T141341B46B8818B25C6D413BFFE2E018D332727B8E1DE72029D245F647B8A96F0D77A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893359, "uuid": "e663f910-4811-46fd-9823-9fb401b5057c", "value": "6144:S0gCf3mP28IAIbEPuMQ4a+LaPtkywPI0yALd4jj2t:df2qAIbEPM4a+QtkTPI0yALOjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765893359, "uuid": "f6fb01da-ccd5-4d63-8e08-f1fcccc13ccd", "value": 232332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765893359, "uuid": "b09f89ba-81fb-4873-86ee-bbeae4c13ae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893359, "uuid": "be16fc92-119d-45c8-bfbb-cad593c877ac", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3031597-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879614, "uuid": "4675ff09-1892-4408-9cdd-4de31bb7b02d", "comment": "Malware payload (Rhadamanthys)", "value": "732fd030f10e2aa0f855a72f1179e028", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879614, "uuid": "a747c548-f10e-4348-882d-a2acc989ad89", "comment": "Malware payload (Rhadamanthys)", "value": "c25b94569db37640703dde9ab47cc1f6bf660cc70815fb7a118b00228cba0765", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879614, "uuid": "532bc363-b4fa-4097-b384-cdd5eb568095", "comment": "Malware payload (Rhadamanthys)", "value": "769a216984d0c0acc1a5104ef122a1d4865b6a2d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879614, "uuid": "d9aca942-7d33-42c9-a8f0-263127bb1341", "comment": "Malware payload (Rhadamanthys)", "value": "f69e6fa290028453df5932c42c63ba817f07b1718c8492be7b6d43a64522f61f3bbf1c1cfcb27ef8484db19bd52abdb0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879614, "uuid": "9b194526-23fb-49e1-ab57-cea0961707f4", "value": "T19BA3F8CD5B07A4F91286F88E8E5300959C4FE45781672252C8DBB7386D9EB058AF7FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879614, "uuid": "0c69ce41-9277-43c1-a5db-1b9fc3d0a0fd", "value": "1536:GDB7eKg20BZzrYr47mMvQS/1MAeGFl1T6BkQWJ+aY:GDB7b0j2wMm1T6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879614, "uuid": "a38b9e39-6a85-46f7-9343-ade35986b833", "value": 100697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879614, "uuid": "d273f022-43e0-4b3f-830b-a23cb9dc5b06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879614, "uuid": "25f5e317-ba99-47c0-8afa-cb002a67201d", "value": "invoice-1637482117.pdf (69).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc49dfe4-da4a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765867604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867604, "uuid": "a8b19ee1-d829-4abf-9cfe-9a3ce45b9c49", "comment": "Malware payload", "value": "7ffa1504d4fe4aa3335515da967dc26a", "object_relation": "md5", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867604, "uuid": "89d75edc-0654-441f-a832-4758a1fff474", "comment": "Malware payload", "value": "c2c7a93a3a4fb62c7dbb3472190bce586ef37f20e413fb37015ee44ea5743659", "object_relation": "sha256", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867604, "uuid": "4e49e003-57e0-4ee5-9ce1-6d47c6839538", "comment": "Malware payload", "value": "7a2245d5df366b779c631bce70b8f991346950dd", "object_relation": "sha1", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867604, "uuid": "1fdb8371-1a8a-49e1-9641-f3c5b6a8e6b4", "comment": "Malware payload", "value": "fd8f0bb44eb258fc59e9ea2a8d172d2759d3a85d15f3a02376003e52372fe7a1d62de1f71a97deb3750fde2690009da9", "object_relation": "sha3-384", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867604, "uuid": "7f388d29-e51a-465b-8ef9-5f25515488be", "value": "T10E853320AE56AE3C07B0A329657B9F2E5BA01FDDC16C80DB7BD962CB07167C6444F136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867604, "uuid": "852a480b-4dca-45de-884f-d4df7b4909c1", "value": "24576:MpL5KF/FV8uCPGCQvVVMxRE3om0asXIdiGR9W9SL2SF0BpS1WCiCxYxkQLOfUnot:AQV8uvHMIdyhsmCxNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765867604, "uuid": "97445edf-daa4-4f91-8d42-3f7da5ef7f5c", "value": 1798634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765867604, "uuid": "97abe199-e8c0-4ec2-a50f-fd0c2254f6a3", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867604, "uuid": "3a1e158c-dfb7-4b02-a74f-9c7d9581888c", "value": "1SPhiiiiiiiDec11_phi.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4a6702-da3e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765862079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862079, "uuid": "0d6c3a67-1eca-4e3f-a66c-b0d92deb79bf", "comment": "Malware payload (Mirai)", "value": "c7a99559fa903558e761f6387d9fa69b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862079, "uuid": "2d92a70b-91d9-4dc5-8a13-2c567183145a", "comment": "Malware payload (Mirai)", "value": "c3e8be8ea6fe923d6f6012c2a08bd7442acb6b5a3c6ee1e0630d50a8b84e31fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862079, "uuid": "9b8fe5fa-965d-429a-8ff2-170abb03feb1", "comment": "Malware payload (Mirai)", "value": "f408bd85c554b887bde4d2405456ce0fcc86cfb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862079, "uuid": "3fc2656e-e6c0-4335-9e6b-ea8aa9cd73e6", "comment": "Malware payload (Mirai)", "value": "6dc3994849aa11162538b0966b848a3b2f0fa65ff80168a2e54b3cf128b00a17588272ea1786229da0458e3e311167f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862079, "uuid": "59619e3d-238b-4580-9499-d769e9008192", "value": "T12BD32A06B30C0A47D2632EB03A3F67D093EFDAC121E4F641356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862079, "uuid": "65765ff9-a7d2-482f-9535-dfb65ca33a6c", "value": "1536:cP0nwryWv+n/qZIxoST98z+xpnvTnNIkH5Afg57PMfgvAtI20jDWB/qHs0kBB/zU:ccWv+HoG8z+x57np0gVPM9t9BBben", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765862079, "uuid": "7c75dcc8-16f2-47d3-85d2-d4e43b3bd4c7", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765862079, "uuid": "5b51b4b1-d397-42fe-830d-9c4a17924588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862079, "uuid": "595f3b57-e21c-41c8-af4e-f18ff06cb909", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fab9dd-daa6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906785, "uuid": "76a803cb-24fa-4d7a-8809-256009d3fa80", "comment": "Malware payload (Mirai)", "value": "da5e8ef2ffa4655eface4632231bd794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906785, "uuid": "0d5545dd-00ef-4c33-b155-64d705badd5f", "comment": "Malware payload (Mirai)", "value": "c49e76ebf5de82d3b68be6e53318d58c49d46aaf5a8f52993c24d71c1eb0ee5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906785, "uuid": "bdfb43c9-f3ab-466f-aa97-e22aa5e160d6", "comment": "Malware payload (Mirai)", "value": "7395c55d087764b5a8b0a6b989f6717cbd14eb3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906785, "uuid": "31100381-ed73-4e59-a615-51f158249fc2", "comment": "Malware payload (Mirai)", "value": "28de0eb1fbd1aa2013b455e17ec9ce585fdeff4c568dcf42fdeefb82ba341b7b02b0ac4ac375051aa80cd2777cdad2e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906785, "uuid": "b6122c25-6e77-42db-8c0d-2cb1eca2b575", "value": "T1BEC34B26FC753E37D0D470BB41D38A21F1755B0810A4D629BDF20E9DDE3B2602A9B67A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906785, "uuid": "30427ebd-b2f3-44f5-b09e-d42535033d6a", "value": "1536:xAbGS1a/TMReF053TVfXmiVW4Ox05jOBBk9hEtj3fWh0/U4KXas7/YdDjN2Bh:x2XsCeFS+mOrKqnDjABh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906785, "uuid": "6c8045ea-6f9c-45c8-b1c8-3b812a2520e9", "value": 118716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906785, "uuid": "171da04c-be5a-4068-9d97-72a7ae610d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906785, "uuid": "d26c0f1d-bbba-4211-af89-6a4b0b9c3876", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b33c61-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879699, "uuid": "fbe37be2-50bd-434c-ac43-cc1192832a60", "comment": "Malware payload (Rhadamanthys)", "value": "09a969f7bf857b3a82f9c3711b2d3655", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879699, "uuid": "2cc4b322-9125-4205-9e50-9bfcfdcca878", "comment": "Malware payload (Rhadamanthys)", "value": "c4d864110b1cd23cbe309e621fc97b90e42dcbfcb7cff09dcea9c6d41b5422b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879699, "uuid": "f9039f4c-48e0-48fc-882d-828a845097b7", "comment": "Malware payload (Rhadamanthys)", "value": "5290cecbd4a78601d7fda95e450136d50c5ce7d5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879699, "uuid": "5e1e0674-8ef0-45d9-874b-e1af4bf95297", "comment": "Malware payload (Rhadamanthys)", "value": "1c7b4186e3bee88ea63819b8d8260a89600630bd8b3c687b0862dcd2c53273dec3a0fbd8e001123845082828f9f5875d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879699, "uuid": "b4610d44-b537-4995-b289-c5d60572e354", "value": "T1ADA3C6479EB074D11136F7A1E92625E3CA1741344C6D58AE845BEAAF370E34CACF24E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879699, "uuid": "edff318f-5c78-4991-b1b1-39f7b7ddd097", "value": "1536:GDB7eKg20gU46IvILlfD+SZCT8dukTD2lh+HwbHrT6eaRovUjJgJsqVa4oiSrzCb:GDB7b0ad23PBC+QLRo6zCsO6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879699, "uuid": "6f1dcd08-e17a-4e19-b9a0-8f20857ec72a", "value": 100708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879699, "uuid": "c902c5fa-bcdf-43e0-94f1-7a5e950f5c27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879699, "uuid": "0779545d-a64b-4d7c-882b-044931bd2ff5", "value": "invoice-1637482117.pdf (53).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae971d3-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765879278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879278, "uuid": "14776503-854a-4fc6-9b31-605f7f6469e1", "comment": "Malware payload (Formbook)", "value": "494648e987985bea5fe8695d4fc9bea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879278, "uuid": "5ff26466-4626-4a06-ac73-7ebcfde6a08b", "comment": "Malware payload (Formbook)", "value": "c585b5196d878bb2150ecfbf45a7aeb67ce1f33801b0c69a5c2ad7a29c00418a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879278, "uuid": "174b8b0c-a939-4b8c-af3f-d019ef9fc918", "comment": "Malware payload (Formbook)", "value": "62e319f55f1549b82f2da8c8deb027816752cdc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879278, "uuid": "99d77604-98a4-4557-935f-be74cf113a39", "comment": "Malware payload (Formbook)", "value": "21e4fcb48cb9e982949e226b1f1d050e638472ccf9b24642ff330f9dde7be8f311b668b94b34cdb0e65e40e9009a90b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879278, "uuid": "f8618bdb-1c0b-4ced-9957-9a67f14247e5", "value": "T194E4F1D03E36AB16CDB08A749524EC7843791F68B011BAE31DEE7B9B77D92109A0CF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879278, "uuid": "ed7be52d-c88b-4073-9ca4-63d3667e3b56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879278, "uuid": "aa921e80-c235-4941-8653-56d466b828e4", "value": "12288:W64LAlLOSqwZzYtGm0P1FJPWOZIMzZCEeVuaSMXlbaMGsBQOLO:lZv2Gm0P1OgzZChVfpl6Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879278, "uuid": "b0a375d3-0849-49b6-8a37-66807bf12078", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879278, "uuid": "5395d048-2707-4eb5-9f3b-6aa1e6cbcc93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879278, "uuid": "4c4283d3-1995-4e3c-b8bd-052fd4b36cf8", "value": "rCONTRACT-ILDCDEC16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611c643f-daa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905569, "uuid": "33199c20-3f20-4f93-9c9b-b68a3b207f61", "comment": "Malware payload (Mirai)", "value": "9e5229bb3853e2bca11bc00d160a6a3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905569, "uuid": "0b45acf9-8514-4857-a0b6-111771a4a8e6", "comment": "Malware payload (Mirai)", "value": "c5d5d52f9d85086259cdacc123707da31bda1ead8de49c1329a020b3cba39f03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905569, "uuid": "fe1941bd-767b-40de-8447-5e63484a049b", "comment": "Malware payload (Mirai)", "value": "2156d4c74f2e03781596727c5b38ddbf1d11586b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905569, "uuid": "5cca4953-cf32-41a2-9a16-297e0f127a40", "comment": "Malware payload (Mirai)", "value": "aef02299ec2e47dcfc0fbb1c8279ed939c44b5e1cf660d199f3d1a7fc1e029d7a919e684a2f8424365867f2b27bf791c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905569, "uuid": "f20d831b-fbe1-4a30-8cfa-165a61bb789f", "value": "T1D4149E72D835AE94C110D978F0F49E752F7259A041472FBF1AEAC1B54487CA8F60A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905569, "uuid": "dce538bf-5f1d-42bb-b87e-29848e8046c1", "value": "3072:kYtJW9ps+13m1B5K9pgRT5xcd0PMxZnLEacqIFD7HgWEq07xHDE:kYHWLj3yXjcd00vAapIFD7HpE77xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905569, "uuid": "b177a73c-c5f5-4847-9d48-f35b9c898800", "value": 199436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905569, "uuid": "9e54f3d1-e0dc-43eb-ad63-04eaa4971246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905569, "uuid": "17c169fd-7770-4c59-b257-c0222bf31d4f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555960f9-da8e-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765896530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896530, "uuid": "704a4780-f83c-4ae1-a850-a7332c650105", "comment": "Malware payload (RemcosRAT)", "value": "cae735fb19fd5e49dafa4ac8e540cc9f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896530, "uuid": "4c2bbd50-6cc1-4df9-b4cc-1b273822b267", "comment": "Malware payload (RemcosRAT)", "value": "c6fa6c09db8169e076fa2206bc26e9b72126608d3b57a5300c045914bb9420f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896530, "uuid": "d229b107-d7c2-4ccf-b558-9b639d321e86", "comment": "Malware payload (RemcosRAT)", "value": "d0559fc9e01969aa3772891009192f2f4ccc7f04", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896530, "uuid": "b0dc44ce-2926-460c-a09d-6569f1558717", "comment": "Malware payload (RemcosRAT)", "value": "17a2ed7784e0116e6193d86062e31dc0de4ba03f76f018864c0979a37989c7a9c17f4cd326c34e7e2a87b652fbf13582", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896530, "uuid": "001db79e-f714-4790-b3bf-10ce8d57f074", "value": "T15003338C3AD2B870537675B33C2BA19FB77D1C84B50C8196D3669891F938318C572BAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896530, "uuid": "0a28756c-e060-4264-9d08-85ccb31b39c2", "value": "768:FpW+cq96P8rXDVtKhqCBWaPNbSuJMPM8t:FLcqr16Ua1DMBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896530, "uuid": "9e001612-eea8-4445-8a58-55f3dc7bafc6", "value": 41144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896530, "uuid": "a7460545-c991-4022-ba98-6088fba11ced", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896530, "uuid": "7af50354-d979-4ce4-a39b-b23cf954e58e", "value": "RFQ#9908.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb0a25d-da49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765867121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867121, "uuid": "2ffe39cd-d595-48e7-b581-42ae62e3280c", "comment": "Malware payload (Mirai)", "value": "b93529ff414021d071b6dc7a050de48f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867121, "uuid": "2bc692f3-a093-4781-92b5-5f5f023521f9", "comment": "Malware payload (Mirai)", "value": "c72536ae5e7c06e1e0699bf35fab59bc0709086894797e76ab69001f806c3f25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867121, "uuid": "1f31135b-b20c-4c49-a6a2-8d48b5a84106", "comment": "Malware payload (Mirai)", "value": "d725f873bc396a813505a804d50dc8be193c1e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867121, "uuid": "42efb814-a4f1-45f8-9c58-b02a6096f3eb", "comment": "Malware payload (Mirai)", "value": "3b6f527503f50610ffe55c427122753b093203b869e777534f739711ec50072ec87ef517ad5a1f5c25f3a02c15ee1042", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867121, "uuid": "b607ea82-23fd-48ad-bc91-fc97a5c0e11c", "value": "T1D8E329DBF800DDFAF80AE33748530906B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867121, "uuid": "1b228406-fb52-465e-8b56-a59564a94234", "value": "3072:jRsZqXhrvKbbWOftDA4EslibVrjbiJLnN+eAyaih7a:tsvnfhAUliwLnNMyao7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765867121, "uuid": "5e51681d-968e-475e-a65b-ba091cfd42a3", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765867121, "uuid": "ac86e512-3314-477c-be30-ccf7ea2eb4b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867121, "uuid": "84eb51bf-3033-405d-89da-04ec014ff0d5", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2510211b-daac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765909333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909333, "uuid": "960c8606-c0ca-446a-baa6-0bd82609b007", "comment": "Malware payload (Mirai)", "value": "b8f08b103731403d4bad997f1da1b79d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909333, "uuid": "cddd2f77-fbe1-4965-95a9-e962f1ac1678", "comment": "Malware payload (Mirai)", "value": "c8400a3660cda29c60eec4c52d38bbe1c0662bdc1ab07bc1cd44055c27c21856", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909333, "uuid": "c7f0e32e-8dbf-48be-8c57-a9c333501a39", "comment": "Malware payload (Mirai)", "value": "796fdec43a767f6587a6fbfd2759e8e6dc7211da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909333, "uuid": "d52cc8d5-1ccd-42e0-a61d-3de10caa762e", "comment": "Malware payload (Mirai)", "value": "06515f4796146ba8ca80d6ccb8dfbe4c87c725a06479dbb71cc45896b3302f06bcbc33a4fffe0b24137f73b73c5f10bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909333, "uuid": "b72b6e6e-a785-490d-95b6-0d052c08e3ed", "value": "T1A79309147D418A16E6D4237BFE9E029C336673A8D0DE740FAC142F97F3A66170D3A91A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909333, "uuid": "f6e8df65-7c31-4df3-9e62-b9296f3c6b85", "value": "1536:gjdG5JSHPKCVDGH8YSkX1+NzzAWEDnr18nF5:gj4rKkXAFD4nr18nF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765909333, "uuid": "67bb1e04-1936-4010-beec-2ccd5cee358d", "value": 89596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765909333, "uuid": "a4eb49a6-953b-4a7c-a087-da0446aeef05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909333, "uuid": "a79a9ddb-fb57-4ffd-a76a-b0934b7d577f", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e8b50a-da8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765896442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896442, "uuid": "228bd847-1219-489f-9757-d52c579b296c", "comment": "Malware payload (Formbook)", "value": "ede6ae24f700870c595cda22439ca829", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896442, "uuid": "53476bee-a8c8-4fd7-8cab-128df1a95081", "comment": "Malware payload (Formbook)", "value": "c886436d3ac4ce559e52e76ce79263810f6709f296816cdebd8c13e17d3ef1dd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896442, "uuid": "b8dc0346-ef2d-4d5c-9949-86c2ac7e87c8", "comment": "Malware payload (Formbook)", "value": "d21f2481b2775a674e5099734420e4305d7f7457", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896442, "uuid": "06154067-5d95-4041-b9b6-2dd2e28dd498", "comment": "Malware payload (Formbook)", "value": "ef643ce709bd19387070e22440b86c1dfc37831819de1bb618ccd08934a6d4bce79c9a87cf97fc607a7f3dbc59402243", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896442, "uuid": "0977cad2-566b-4aeb-be88-171f5302eac8", "value": "T13AC378C53BE2F82122672272363BA5EBE63D8C4171CC48D9F5917C98F5AC718F7A5488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896442, "uuid": "467075f8-aa3c-4dc3-bf50-d118a9a93780", "value": "1536:woqZ9egqrvLN6fUeTrEuMCqJ+TgdMizDzjzp3geD1mpnr1X5al4ICzoGrOC+yV4L:mDLUe/JkdjDftwuAhX5Y4zznaC+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896442, "uuid": "866668a4-f3c8-41ec-b3a2-bac50a229fa6", "value": 120672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896442, "uuid": "699715ce-a74a-4ca9-947e-a38b467057da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896442, "uuid": "3f3337b2-a774-4726-9883-4dba5e41b4a6", "value": "Electroglass Ltd PO-7211-A25 Dec 2025 pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2ccf43-da7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765888813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888813, "uuid": "9bee5580-43b9-4d9a-b1a5-050f16494b80", "comment": "Malware payload (Mirai)", "value": "fa57f4d28160d85da8b110fe72c1d70f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888813, "uuid": "28e76f89-3f6c-497d-bc5c-ba954ed50e7d", "comment": "Malware payload (Mirai)", "value": "c89f31198fbfa90e031b5325004dcf1332e9f8c5649ae65a4de9694b8df83328", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888813, "uuid": "4d5934e6-7e0b-4ed2-8e74-9a443ace5ce2", "comment": "Malware payload (Mirai)", "value": "ed9dd69caaadff70884e0c9ceffab8a0cd4df448", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888813, "uuid": "5999c769-2e21-4262-bcb5-5ce04ad714b9", "comment": "Malware payload (Mirai)", "value": "16ec0d8a47ffb91378cc34da8b91bd10aa07d7a703ebbeafb72e9fcb2247196f50bef25b3e01c5aa522ca724f2e33d7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888813, "uuid": "61786897-0cd6-452f-a6fc-3c60c1061059", "value": "T1F0B33AA5EA92D4B9F9290535712157B28534FD3A015FDBCBFFA46932BC20F028149BEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888813, "uuid": "1492c7b8-0512-4468-9c58-2a50979f9bcf", "value": "3072:GsLLO8tDPaPBqldiIYmsEXjSHBUh43EoDIuuu:GALOQQ4lfYmsEXjIEo8uuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888813, "uuid": "cb5d2799-39a9-44fe-8dad-31cb66e0bb40", "value": 111568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888813, "uuid": "ff2a12a3-5e0c-419c-9f98-c6ed71d7835f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888813, "uuid": "53f2ac09-0de2-4a89-822d-5a37b13e35d4", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1742816f-da62-11f0-a129-42010a9c0007", "comment": "Malware payload (Metasploit)", "timestamp": 1765877528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877528, "uuid": "c9815526-107d-4bfd-9887-f024b2420531", "comment": "Malware payload (Metasploit)", "value": "4c76d2b851ed9a76bb803677169cfb15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877528, "uuid": "827c66c4-0ec7-4b88-b28d-018241a6777f", "comment": "Malware payload (Metasploit)", "value": "c8e1227234a4ebfa49902d7b6816c9c3a1db55f5d367b8d114e52c09c6157b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877528, "uuid": "dd901cb4-4d72-4a35-b291-d785634730a0", "comment": "Malware payload (Metasploit)", "value": "f9daa251cbf612f844b1338af4f49aff8c6c6676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765877528, "uuid": "3ab067a5-6326-4304-a0d8-4c8898f4578f", "comment": "Malware payload (Metasploit)", "value": "550f445ab000121a9c877b3bfd7c1dfc7e9b54efecfb97e36d863b29381ee45ff4ec96c0c47dc40e3d42d769be8101d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877528, "uuid": "bcaeafa2-21f4-47ad-8a49-6866614d220a", "value": "T15EA2074BB15125CCC02401758427AE6AA8A2FD280B7141F72737FB1E2DF97D01AFB99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877528, "uuid": "0e698f0f-122a-429b-887d-a6e075c0d3ea", "value": "95c36ed7f5411f51c61f75e419d00bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877528, "uuid": "060e9276-3986-48bd-be07-645b6303f94a", "value": "384:jghccRi47aOSsXcsuXczy8v0Wi6IDZBiL4ccjyToU:jg3lXbuX0y8v0WXI9QkccjyTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765877528, "uuid": "43a7587c-2b2c-48f3-927e-c75b13657fcf", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765877528, "uuid": "ae6ff044-352e-4d40-9f4e-5d1228dbd731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765877528, "uuid": "2062d846-15b9-4621-8ce2-5aea78e55ab9", "value": "med.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf67ffc1-da77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886829, "uuid": "52212f44-ad80-4a6f-ad55-598b4c162fd6", "comment": "Malware payload (Mirai)", "value": "89dcbd20108721d2b56c3c5ebbd36a9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886829, "uuid": "02c70638-b3a0-4942-a9bf-74f21463b058", "comment": "Malware payload (Mirai)", "value": "c8e82483164b9f0faee69afa85d9b158f339bddd0339a0358dd11aedf4f1fa8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886829, "uuid": "e961acb6-438f-4a7d-b88d-53e7d6ae499e", "comment": "Malware payload (Mirai)", "value": "01f1ab215278da55ded846149239d02d28f39e28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886829, "uuid": "f145e87b-740d-4561-8876-1a8866c65ac8", "comment": "Malware payload (Mirai)", "value": "7276111ca4ea69b6455563d03a7739673ca5af2b0af88a117e859ee665b899f711d80257e6b79cc927a6bd89f56f9ca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886829, "uuid": "c92e7646-2182-439c-805d-a7aec34b5fba", "value": "T119C32A057C819A22D6E7237BFF6F029E332A5394D3DE710BAC201B54779A8270E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886829, "uuid": "6e4c4ed0-52b6-4808-9fd7-a2e2924da793", "value": "1536:Wn7Ol2Md392ZB2oLyEj7LFVBt7HzzdqMVUf7kVRRuzdEfB4f8ndo5fY:WnKc7jPFjNTOf7kVRRC2fCf8nm5fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886829, "uuid": "e8e04125-9272-44e7-91a7-b25bfad1359c", "value": 118644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886829, "uuid": "7cf7551e-6a7a-4a94-acc5-1ed3a81f4380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886829, "uuid": "6a43678d-8b8e-4187-b5ec-44078a67c75d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1a0a56-da7d-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1765889511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889511, "uuid": "97086802-5a3f-4dda-baa6-ec6bab3588ca", "comment": "Malware payload (HijackLoader)", "value": "649ff3d1566be3b74381d046f09de7ca", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889511, "uuid": "46c1380f-fcf4-4758-9e5e-99be1487a8f1", "comment": "Malware payload (HijackLoader)", "value": "ca34f48a3b475cc0ab857b246de9916602f6348fb32e516594d91de3d0498fdf", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889511, "uuid": "b649aa95-6042-4501-b1a5-aba6e78d0b6e", "comment": "Malware payload (HijackLoader)", "value": "9296f9765c40a4101316b8deaf56166bbe5d3525", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889511, "uuid": "4002e444-b9b4-444b-9ad6-b4055600db32", "comment": "Malware payload (HijackLoader)", "value": "ffc9c084bc92a55735c8a753ebbe49a43b1d886cd24e2be08901b24a93ec4dcaa3480a1a5efedcbf9d924619503cecc9", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "empowerhouseproject-org", "colour": "#E79E7D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889511, "uuid": "8ca065f7-8886-4fe0-9201-299e4549fc6d", "value": "T1AE86330F8BC295B0558350868598F3B271B27DC643641F0EE6AFC790A7CAAFB6573748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889511, "uuid": "5b69ed3b-5ffa-4d49-b0ee-df9bd14b395d", "value": "196608:a1X0hdBUx/aZnbltlYJ542P4LmkrvMYNaRxORwDT5ZCCWT:ox9ol0JNP4xvCRrnDCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889511, "uuid": "e1d697c2-2837-464f-befd-7cbb42a8deea", "value": 8017629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889511, "uuid": "4aa98455-8eb0-4b30-8da6-70855ef07aca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889511, "uuid": "f7450c47-af6a-49ab-b7a8-6e2ea28613a7", "value": "yamityyqsopa(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e9a0dd-da7f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765890221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890221, "uuid": "e17b1408-8707-4a43-89bf-22c99880c6f9", "comment": "Malware payload (Mirai)", "value": "19c38a7544caf48caa4c68ccb8458dd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890221, "uuid": "e21f8982-49fa-4d22-b32b-f6ee3d0bacf5", "comment": "Malware payload (Mirai)", "value": "ca452cf2d39f142566e758f35616d1773bed803e753a69b9ee55d33133b8c468", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890221, "uuid": "ee5bb264-0af3-4069-9b5b-86ed54237cfc", "comment": "Malware payload (Mirai)", "value": "4ec0e24c1ef447b862b3be47ae37a5b2793b8314", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890221, "uuid": "dac209b8-0d36-4ea4-b606-752d658d42f0", "comment": "Malware payload (Mirai)", "value": "3e071ef300fbf07c2ecd37d775b2812a14efab908d896b67f655b2c58bd73bdd81968ae93c225225a658fb1a71e7f9f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890221, "uuid": "a1a189a8-8e2d-412a-bc73-8d68bd87e2ca", "value": "T1EFB32915BC419B26D6E32A7BFF5E02DCB3265394D3DE710BA8201B55B3AB81B0D3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890221, "uuid": "60bc5eb6-e80a-4025-8f19-6104eae7ce0b", "value": "1536:i1COy23K6vpZ5aIEy7o1BXEGzzd8LjwifzkGRIWPCLzhFy/28nTo5:i15JDUBXE2CfzkGRIW6hFA28n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890221, "uuid": "484be176-9b60-49ea-9de7-ae98452bb473", "value": 117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890221, "uuid": "1846d228-2358-4f3b-9318-50349769bda5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890221, "uuid": "bccb8e93-475e-45cb-8e48-d2ad5532b6fa", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cb562a-da67-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765879975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879975, "uuid": "2c726f0a-1dcb-45be-9a95-18609270a0f3", "comment": "Malware payload", "value": "1cdb19fbd75bb75c7e9bb5988c42a0d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879975, "uuid": "60c656d1-a7af-44a8-a307-9e52cadc1e74", "comment": "Malware payload", "value": "ca9fbdce9aea6ac696d1df512fa4681ce55e7719ec74cbd91b2b2b9a00316307", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879975, "uuid": "70847645-b037-44aa-8ba5-68bef97e7fd4", "comment": "Malware payload", "value": "f1d78093c3fab46b509ad7a349b809dc21d976f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879975, "uuid": "ddb8af99-8844-49d6-8eda-9d9bd0e7a876", "comment": "Malware payload", "value": "ce77452442fbb5587101822bd7d47d4a3e7a18eb61354ae796dc719613acb46830c43da511a86461fecbc3d394cb9a66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879975, "uuid": "e0b74b68-b50a-4c23-b93d-6be68a4183d9", "value": "T1DEA3F89D9EA27EF94F61BBD345C9101A8C4388604F040569C05BBFE19ACEFA97F910DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879975, "uuid": "b3c2b13e-9325-4780-a8e9-d2dcb07bb010", "value": "1536:GDB7eKg20NYd47tG+MvJLAQmcnDpS+Ovtgl8tlZg6dxcjaoTwXMMO9zrzjfuJCrl:GDB7b0UTzSDci6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879975, "uuid": "82312baf-7ee6-4731-a0e9-590748c0282c", "value": 106082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879975, "uuid": "378a81cb-9d6e-4b1a-831a-7ae0f055b433", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879975, "uuid": "9ebee26f-3cb3-4975-9aa8-2e7e73ca2449", "value": "invoice-1637482117.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1cf7e1-dab2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765912166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912166, "uuid": "0d33da50-e4de-4a9e-abd3-7045c92a08e4", "comment": "Malware payload (Mirai)", "value": "a4aa58e25e6d565f546699a386cdf5ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912166, "uuid": "65cfde9c-3fc8-482d-9d53-e2393e3ea4e2", "comment": "Malware payload (Mirai)", "value": "caf306ec6e1b39f7e0e5475d6549e1c677410b6eafca3e7754e36c52d32bbc99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912166, "uuid": "12624428-40e0-4f9b-b6ab-c791aea6f686", "comment": "Malware payload (Mirai)", "value": "d82f465c931e47b5af394fc2c8d0d0d7785a56f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912166, "uuid": "5044ccd3-26c8-45af-81c4-18beec89f0ad", "comment": "Malware payload (Mirai)", "value": "d89bc1d673fd47b620224e4ee3457776e11632257cc7084a3f76ad0975fc549877658d14a1b76a291cbad30c32324954", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912166, "uuid": "79288b11-9033-4060-a63f-a3ab703bc605", "value": "T135B38E2280548FE8D29C4DB164906D7E93166411A69F3E7E9BF484E0418BE5FF1CE3EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912166, "uuid": "742a3873-a8d0-44ec-87d2-0be18d99ae15", "value": "1536:m6wSJuvaBpkx9y6jXgsSkeAmAMnwgOs6UIABVCLxAZq3CghVRBV:m6AvIs46jXgsSkeADM/IABVGweCgXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912166, "uuid": "b2d2ba50-7501-4d70-9162-c08ebab35549", "value": 108048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912166, "uuid": "f444459f-b88c-4455-9900-f3efdbe06e67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912166, "uuid": "b914cea6-7bce-4c3a-a36e-b60243dd1b67", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c55198-da7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765889491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889491, "uuid": "fa6bc59d-1543-459d-9794-ba1152ae7a22", "comment": "Malware payload (Mirai)", "value": "e55e9f2f6a49a472d3ff72e6de8a5fc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889491, "uuid": "fed9d114-34ea-4d75-b36b-af28a2f49e87", "comment": "Malware payload (Mirai)", "value": "cb379bd4f8e21b85bcedac55f86a2bd94b4b8abc1e45ad0d13564b6df596f9ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889491, "uuid": "c8dfa4bc-37c0-484c-9dc0-b40da73e4289", "comment": "Malware payload (Mirai)", "value": "3220fb75f3d988c4a9fbd6ba66afa653ea8c2da8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889491, "uuid": "c642e971-1c2d-44a4-951b-7f6ee942ea6d", "comment": "Malware payload (Mirai)", "value": "0aeaafce913aad0c0cc4b0f342442f75450d9235e3d64d4819a27477b2b0cbb40b35f48e1c490f1a75b5a62f27d6b41e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889491, "uuid": "cad772cf-aa27-469a-a965-11a1e57be5e8", "value": "T1B0C30755BD429A22C6D7A377FE5E129C332613D8F3DE720BE8281F55738E0260D3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889491, "uuid": "ca3b2c21-6ae5-4cdf-8487-bb90dabf6ccb", "value": "1536:lZ6mJKW+8zbiWot5tRAWdk2zzj2ZSPtszibzhGCfQr+cAx9S2avY8nTo5W:lZBUDqWdkGgzMzhjgmxLoY8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889491, "uuid": "be9364f0-b38f-4cb3-b86a-984177409128", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889491, "uuid": "54ea9ccd-1bcb-4216-92ae-769c6f58380e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889491, "uuid": "cb0f7744-9d12-4b2c-a798-25c97b641eef", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ad41a6-da53-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765871143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871143, "uuid": "2600ea6b-2029-4ed8-a546-70852a856d65", "comment": "Malware payload", "value": "40ac47a3a5d89a23d783a434f268b1d4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871143, "uuid": "d86c387f-5605-4a1b-894f-1c9601b90e23", "comment": "Malware payload", "value": "cbbc0cf0cbc3d13250a22276d46d3ecbcd283a1635bdee3030c1970b05997955", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871143, "uuid": "905fe362-9411-4a73-a0b6-2537c6837722", "comment": "Malware payload", "value": "e3f7f72e30e975c28524da1dd7221c912504ebfb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765871143, "uuid": "cc6409be-7eec-4d68-932e-56153e85ab5c", "comment": "Malware payload", "value": "07f19dbcb14ea7dea0f08508f9cb2ba7fc6a935493944a4bf8b004ffa1ab410bf9db5325418a8f6267b9c8880c0a6680", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871143, "uuid": "72a95312-477c-4801-999a-9f223b69c728", "value": "T104060186FB15003BC0BB463246AA536112AF4C4BC9D37B87B554B21C6D7378C9FAEE58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871143, "uuid": "064c35e7-b6e1-40b7-ac8c-6bf373e4bc20", "value": "98304:737nIx0Nn78ASN9zHe6cuYfPEdKRSd8cWmdG30poDU0/oreVL:fnIx014ASN9SrlcdrSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765871143, "uuid": "479b705e-8624-4923-a2e2-46b6a76a0222", "value": 3834788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765871143, "uuid": "08635c00-6a68-4ded-bd96-e35421e02198", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765871143, "uuid": "ea07cf4b-b903-4ed7-8bc7-69865fa5fd2a", "value": "apps.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca0b935-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879416, "uuid": "05605894-197e-49ca-90e9-0ff363044a9c", "comment": "Malware payload (Rhadamanthys)", "value": "273e881abf705fa539c04a8b50e38426", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879416, "uuid": "affb7c8b-89a0-4ca3-a7fe-ac5428d45766", "comment": "Malware payload (Rhadamanthys)", "value": "cbc48489307352e227b676b5522ca5b2d4378373bab4293537bd844d0a6df1b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879416, "uuid": "c83fee3d-0eb8-431d-a449-acd7b7fc200a", "comment": "Malware payload (Rhadamanthys)", "value": "d5c93c6f3808146e63a8dd670139e3252ab66ec5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879416, "uuid": "0d9d9f9b-5a36-49c5-98a3-7bf4f3a6ebea", "comment": "Malware payload (Rhadamanthys)", "value": "7a255c71fd4fecc00b63adf03fb75050c60969ed43619b1eb3136fd31f143a49b49f7371cb7177314424a95637cc3157", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879416, "uuid": "8d8b7f54-7066-484d-a1d5-ee38518f7671", "value": "T127A3F8046F5B3AF90061B69E9F4854B5890F0052D16A627B54AFFBF1C3EC79B099D0CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879416, "uuid": "1d599892-1405-428d-abf2-cb6f2ebd48e3", "value": "768:GDhd0i7J4sYKgY/CMNfWdmYScrXy+r3DjWH9GAQ1lFKSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20JrTr3Dj6GAQz86BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879416, "uuid": "9973b4f1-85a2-4951-8e5e-757f57fe1e22", "value": 98747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879416, "uuid": "fb50bc84-4cbf-479c-b975-8ea9b35566fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879416, "uuid": "b1a67a24-8f34-47c9-b609-3fc4cae4dc41", "value": "invoice-1637482117.pdf (99).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e4ec31-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765880027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880027, "uuid": "0932de60-166d-4f46-b45f-23cd2a9b9517", "comment": "Malware payload (Rhadamanthys)", "value": "d9e21a81c0da5830b643a15b8bc85085", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880027, "uuid": "086f914a-e52d-4621-8771-b709ec24986b", "comment": "Malware payload (Rhadamanthys)", "value": "cc17481bd9042000d7cd6cac4727e4f23ce2408180e99feee3348df7fa2d69df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880027, "uuid": "c447853e-a0ba-4602-9682-a78c5cb45eb6", "comment": "Malware payload (Rhadamanthys)", "value": "83e063c749c9c81bd4a36aef49b5f0d2b6313263", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880027, "uuid": "ddfc72e9-7af1-4f4a-9a3a-187cb510bada", "comment": "Malware payload (Rhadamanthys)", "value": "a6b1ff6def56d0dfeb0d7b6e9de53a459684a9ec69865e39ee9a0b9f7760305f8c1c839c1868f1f7a3dd664f800e2452", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880027, "uuid": "ed8c8a11-7c12-49c3-886f-085fe0f956ff", "value": "T14AA3D9456A73FCE041A3E3683CE023E87C2A4649548F55BA9487F7E0614E6512DF9ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880027, "uuid": "8f495de9-569a-48cf-bf04-8f173d6c696f", "value": "1536:GDB7eKg207fhP4Lk7TyTTgkAgTiM7EqQ7FdB+vXpQ2jbklmkgUCUX5redr7g+zp/:GDB7b0/JZpOJUtuRHHiyri756BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880027, "uuid": "c25843e6-55e8-40a1-b5c1-c93761c56444", "value": 98794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880027, "uuid": "c79936d7-2019-4f4c-a7b7-b9622a4cd3d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880027, "uuid": "f2674ed3-d9d7-47f8-8e63-dd561201d44e", "value": "invoice-1637482117.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdd6424-da1e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765848653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848653, "uuid": "26ccb88e-a13b-4f14-91fe-cefb74490fd9", "comment": "Malware payload (Mirai)", "value": "92d33d1af76531ae08433d501ebf9594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848653, "uuid": "91ac7f1f-5609-453c-bb44-9149460fae4b", "comment": "Malware payload (Mirai)", "value": "cc50f4e5bf8040fdf1c83b0b184631790fe5fc80fb465600b9edb1ad27c9064f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848653, "uuid": "99c32e05-aaff-49d7-9614-961d05fa5510", "comment": "Malware payload (Mirai)", "value": "bb33f5384add372a3328a40be332a823ced745bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848653, "uuid": "c19e73f3-38e6-42b2-8991-365d454f4281", "comment": "Malware payload (Mirai)", "value": "7a8f93a3b4b7b37bd6c30528b10776fdd0ea8a6047253d8159dbda99ee107340d33f22f6d8059def5bcd91dab1e39ff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848653, "uuid": "ec395a4b-a29d-4ffe-b6f3-dd5b612d9499", "value": "T155634B49FAC3C4FAE8470972503BDB62C7B3E92F109ADA43C36C5835DD52642A61779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848653, "uuid": "c3eb6a10-69a1-4687-ad26-a0498e9ed924", "value": "768:l0INxYbyFsC+ZQ6YpQ9IG2sgqG53leVcQ0cQSpH95GZoI0D6iqyRp38uPSRI97:ltXKyFsC1KIGBgqnCLDSvVjFPSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765848653, "uuid": "31271093-6597-49c9-bd4e-dd211a2f9edf", "value": 67496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765848653, "uuid": "3994d6e0-ba9b-4722-a3e7-dd17ba891019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848653, "uuid": "cde79418-094a-4de6-9187-e413bb884e00", "value": "nuklear.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e90345-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879678, "uuid": "a74cbb73-5de2-4976-af86-b906c884a47f", "comment": "Malware payload (Rhadamanthys)", "value": "2007aa8c1188a9eee2e571b67fbcba33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879678, "uuid": "c7feb2c3-1547-47cf-a71e-75b931c22676", "comment": "Malware payload (Rhadamanthys)", "value": "ccc28c3e03b9df0309a650f35f6c890d45b5cfea2ca4681be377baff5c7ab5d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879678, "uuid": "b706f718-d547-4a07-ac69-58f1d5832956", "comment": "Malware payload (Rhadamanthys)", "value": "2d0ec2ffdecb2fe3f9daeebf5069c308609fcd60", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879678, "uuid": "829589dc-760b-4568-9dc2-23117807e20d", "comment": "Malware payload (Rhadamanthys)", "value": "521fb3ebd5be3ef73b9d7972bc354731cf44ab40d4ff647abb547c36cfdd88bac2422d6bcfbb3848bd8f471bb580d780", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879678, "uuid": "35848069-16bf-43cf-9d54-ce5886b05210", "value": "T1B0932ADE5DA7FCF831F46A6998F5944CCD0CC66924D0423D3797F6A219AF12308C9A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879678, "uuid": "cd53b702-9be4-43da-9916-0ad1eab59433", "value": "768:GDhd0i7J4sYKgY/CMNfWd1orXm6r+4cyHu5DWHAJ1KJZSLAuAAroQW+FF+Ec+0FY:GDB7eKg20SrTr+4cF5OAJ0z6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879678, "uuid": "99a12a10-5b22-4b4a-a359-3eca91334f63", "value": 97526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879678, "uuid": "e44d433e-a6ed-4866-91eb-0c97281917c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879678, "uuid": "cfc51a6b-52d0-4042-aff0-87e3a78e7639", "value": "invoice-1637482117.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3940e77-da7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765888151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888151, "uuid": "0aaa277a-c24d-4259-bbcb-ba69fa774f24", "comment": "Malware payload (Mirai)", "value": "e9d68411b005268f7f33341e98352934", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888151, "uuid": "a65696b6-a742-444a-80e8-192dae2cf4c0", "comment": "Malware payload (Mirai)", "value": "cd00b1d5220a36ee7a06647401c9463bf912dc844f8cc4a5efd43dedfc736121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888151, "uuid": "0f5449f6-39c1-4b69-9366-d9526df87f9d", "comment": "Malware payload (Mirai)", "value": "c11b3a2c56086d87d006848eb16cda5d54cd817a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888151, "uuid": "5986e193-bd94-41fd-a2d6-faf3d7041b06", "comment": "Malware payload (Mirai)", "value": "464ce330325dad9963885b99cdb796068a9b08d5f0ba1a7a24f0aa0a8e07bebd1e0438f8002b13a0779dcee6f741317b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888151, "uuid": "16c04c44-94b4-43a8-bfb7-1bda3d437f1e", "value": "T1B7B37D3280189EF8D7EC0DF175E1497A83126841656B7DFE9AE580E0848BDF7FD4A362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888151, "uuid": "ee286edf-b571-4a88-9717-d2163cd24965", "value": "3072:B4a9Xi9xuvEsZT7GgHccQBXPfbvGICXVn:B4ZYbHdifj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888151, "uuid": "daae779a-36ae-451d-80b4-5a56512223ab", "value": 109920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888151, "uuid": "4963869e-8d6e-4a5e-969f-20a9c9c84671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888151, "uuid": "21cc0391-37db-450e-a3f2-405e857b197b", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21df5326-daa5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906322, "uuid": "51411380-e398-413b-abb8-8fd7fb4c5086", "comment": "Malware payload (Mirai)", "value": "c8f36e31bdb1387382a5526d92d886ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906322, "uuid": "8510113e-a4fc-4961-aed8-c90ed51577a3", "comment": "Malware payload (Mirai)", "value": "cd0e050e94163767ef47df09d6c0589f491a6e1ae7bd8b3e84e2393a4e831c80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906322, "uuid": "8e896f15-ae65-46d7-a4e6-7cf11eeeb2d7", "comment": "Malware payload (Mirai)", "value": "a2d108790a4b8a68c2130bae1123dfa739f7feb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906322, "uuid": "82da65ad-1cb0-4c4d-aad2-ca280be84618", "comment": "Malware payload (Mirai)", "value": "1f29e3cec405bf99ef9cc073df5e1d7f2ddabd34013c86b0fdf81f0d284b0bc7209bf80382709fe49a6b9684508b32d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906322, "uuid": "9abdbb0d-8d99-4709-8094-ebf344b5ae95", "value": "T131B33822FCB53E37D0D061BA42C3853EE6754F4810A89B2ABD624DDC9E3F1602766677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906322, "uuid": "43c19f49-9a89-43d6-b5d1-c5988fa0b004", "value": "1536:iAZeI5VWuuE9ZcVBcO6o0YHtj33sipe8lmq+mxjPnOQsPOpjN2BMuuuyKmZ/x:rlDu1LPl+mxj2SjABMuuuyKmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906322, "uuid": "ed066d82-2852-4056-aa2f-727d405880d6", "value": 107708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906322, "uuid": "b6b9f9af-42dd-4e86-8fa4-6ce96fc33338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906322, "uuid": "1909ba08-78c0-4256-8c1a-c7a0ffb313cc", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8510a905-dad6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765927533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927533, "uuid": "04f97fa7-7363-46c7-9a74-3d165f7d5849", "comment": "Malware payload (Mirai)", "value": "4af93792aeed34c976b6c99f677ad7bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927533, "uuid": "25ad1116-99bc-48b7-be74-63e5c782f861", "comment": "Malware payload (Mirai)", "value": "cd277f27c23ce0b6a06cc53cdd1169193050118d94f87b010898636a9723e496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927533, "uuid": "44f259b6-c284-4935-8500-679802a1648d", "comment": "Malware payload (Mirai)", "value": "9f8261c6b6af701b4654a98d0a1da920b5bf691d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765927533, "uuid": "0308ee0d-506d-41c2-9fd9-7b9deb2f36b6", "comment": "Malware payload (Mirai)", "value": "9b437346068a05694c905371ed6b77e140f171742b69efc7e58812f2cfc67efcee4936ecb9d5b7145b24d4931a7de88e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927533, "uuid": "b08a2378-3881-4e51-8c43-9dd80753dfc3", "value": "T195931A947E429B56C6E8237BFE6F025C3B365394D0DEB11FAC206B45B39B0160D3AA17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927533, "uuid": "0798f0f8-b151-4d55-ab84-3afa20a49729", "value": "1536:fFlmc+vNJj1KcCB9uqvBhm3zzzh1RgO8uKp8nF5Sjfj:fFQjLmhm3v91uO8uKp8nF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765927533, "uuid": "07f82acf-3ab9-42b4-8288-6a6f152ae9a7", "value": 89980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765927533, "uuid": "17cf84b1-72ec-4ae1-964e-d3603aafe65c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765927533, "uuid": "68ff5dc6-664d-448c-8af1-09c9697f7826", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2954d7ea-da50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765869827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869827, "uuid": "0e7831fa-13c9-4ab1-93e1-e284e8ef4e55", "comment": "Malware payload", "value": "c2aae412d522419496b1794b35e10e83", "object_relation": "md5", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869827, "uuid": "46c9ed35-9e8f-4b0e-a99d-3a93aa378c2c", "comment": "Malware payload", "value": "cd3604fb9fe210261de11921ff1bea0a7bf948ad477d063e17863cede1fadc41", "object_relation": "sha256", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869827, "uuid": "3dc4a110-d295-49a8-8c71-c9f8de4893a4", "comment": "Malware payload", "value": "77c39e24a8ed193bafcfc1c00dabeb3cfc6ac3e9", "object_relation": "sha1", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869827, "uuid": "35344a74-ee2a-4339-9610-910fd93cc53a", "comment": "Malware payload", "value": "61eef3fdf7a2e6bad39e55dbf08ed04018d19302647a36d53624ef92d6ecd98808dca3bc7ea86b6d659946f10a2c3343", "object_relation": "sha3-384", "Tag": [ { "name": "2fa-bns-com", "colour": "#BA90B5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869827, "uuid": "b3c308d2-2ba4-4025-917b-c0a5544916ca", "value": "T100D02263C06B0138861F92AC45EDFF08C006C84EBFD495AAD988600D018A6228330353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869827, "uuid": "e7a53c7a-7069-4bbd-8d7d-46a327beaedd", "value": "3:VSJJFIGFjXRFD0rMLLH5UYTM2ZJRyFTsFmZJJQJf7uFBAL561RErXggsTd61REru:s8GFr0WjFZKF4I5QJf740ggd0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765869827, "uuid": "8dfdb7f4-6930-4bdd-a0e7-4d4c233f0742", "value": 195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765869827, "uuid": "7e07d8cf-21f1-4c67-af4c-f1c679212385", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869827, "uuid": "ddd4555c-c929-4c92-b63b-43c31e1e61a3", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3121c8b-da78-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765887238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887238, "uuid": "1b740b38-86df-47d4-9d0e-f1e065f58258", "comment": "Malware payload", "value": "f11c4166f67dc223e02d1e978cc9306d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887238, "uuid": "bbf9ad5b-94db-4f73-81aa-876f0a903c39", "comment": "Malware payload", "value": "cf5731a62909f8f133520f356f4a7555a33a42eee5e05e511f7655475c980580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887238, "uuid": "c684d7e8-ba7e-4ef4-9064-18cb305ba513", "comment": "Malware payload", "value": "eeac5306635870b75a8ade1456363fe8ffa0d209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887238, "uuid": "f1e545ac-360b-4a32-9d00-05973b770435", "comment": "Malware payload", "value": "54dce70fc3123536bdcd8cc4886ebe06ab795c77966f4c126db8e6db7e089ddbec5037916fc619b03d29e9fbde840438", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887238, "uuid": "a616fff6-186c-4417-aed1-40ff30a246de", "value": "T18D833BA06021CDEDED1FC67AC6A20519AE35E6411F520F3BD496FDA7DD221A4F83ACD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887238, "uuid": "246f8093-5433-491c-a55e-6c4e49856f52", "value": "1536:gRS7USSJX0EdtbpUdDwuA/w5aw8ur+K/jEDODZMGwVy:2S7USZEZj/wccBjc2ZMGwVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765887238, "uuid": "54ee0f26-0afb-4d22-81ae-5bbf63dff15e", "value": 84504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765887238, "uuid": "120b1ff4-6ac7-450a-840a-9bb5230957ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887238, "uuid": "b51fa75f-561a-408e-b4b6-98c5f6d814ca", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e20cf4-da6c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765881819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881819, "uuid": "9f060439-b5bd-4d4b-b525-52b6efed7d45", "comment": "Malware payload", "value": "ab4bef832c6437ff9cb2be8d43f2bc74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881819, "uuid": "1cf8ed4d-baad-4bb9-90fe-c01f16f52b27", "comment": "Malware payload", "value": "d024ddad98eba09880ebac8736ccc81c693553b0e9ea9a83de2d77c34e620112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881819, "uuid": "575b9bb2-9d5b-4c59-9f34-d0ef2871335e", "comment": "Malware payload", "value": "599975382a1f1aadef6ebe4a788e795b673686d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881819, "uuid": "444b92ce-c5fa-4eb1-a14e-ede92409b275", "comment": "Malware payload", "value": "c8a8fc9d9ba77c6d6fbd339fde9c97181017d459ed7b889ea7b84a86d1a457969950b730d0c8673e7ebc61b644d2c6b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881819, "uuid": "ec259f50-1ff3-43b1-81e4-ade8a9685351", "value": "T1E0E4F6017288837FF4D23BF0ECD53D2546B97E911B14998762B43F1BF9A31A2ADB1258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881819, "uuid": "3af9610d-078d-44f2-b058-25499b75f9fc", "value": "422c4edd4ea7b6fddb8481c2b41c99d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881819, "uuid": "c6c664d3-68d3-450b-88ac-439e3da77cd0", "value": "12288:Z+fibzOhKcs2LzWbaCczOXDONT0DmqRghEsuvBcyRJPhr:Z+fibbmxzOXCT0Jcyvhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881819, "uuid": "2f98f033-ecd1-417c-9cb2-af96debf4a92", "value": 711792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881819, "uuid": "9085b3e6-cd18-4c06-bca9-6c4c89a99f58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881819, "uuid": "78e79a82-6fd1-4a41-b725-58e80d07d13b", "value": "218.22.21.248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f676f9a3-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879620, "uuid": "62cb33d1-8067-4102-a278-3e976b1e5193", "comment": "Malware payload (Rhadamanthys)", "value": "050b802b7411d24d9bd4e2464d734cc4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879620, "uuid": "f97a022e-cb89-4268-bbdc-1f75c0dba798", "comment": "Malware payload (Rhadamanthys)", "value": "d03418e404fa5b58f210deb48dd2858812c1042cc0414e4cf087248bf850ba60", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879620, "uuid": "a60ebf7c-36c4-4e75-b9da-e5efbaa7c9b2", "comment": "Malware payload (Rhadamanthys)", "value": "662365e3498401173addb98d71c55cfa55948b55", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879620, "uuid": "0b926676-f1f6-4923-82ee-d4a81ba5d4c6", "comment": "Malware payload (Rhadamanthys)", "value": "e256f8df4aa06454728be3969f0fdc9fb42320b93c38d10ca5f9f95e59e4801a17a649abed7ead4a0bd1d832e3580adf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879620, "uuid": "9bc19b90-eae3-4f8b-a486-5c2870ddb237", "value": "T1D2A3D840EE39CEB1F359FB562CDAAAF9899F9A24143E580C911B77340283F1768721D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879620, "uuid": "d86f4ac2-0794-4e64-a94c-22cb44820435", "value": "1536:GDB7eKg20UoRZzUzFhy8AWP28RlQAhMEmCqf5+ZV+iZYC7lX2IlrysQriore13jt:GDB7b0mG0otU06BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879620, "uuid": "cbdf2234-32ff-414b-bbd7-2a6ac3b8363f", "value": 98802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879620, "uuid": "9e52b33b-1eb2-443a-9387-b2b76a3f2203", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879620, "uuid": "8eeb6486-6584-463e-82fa-674be2b3790e", "value": "invoice-1637482117.pdf (67).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38db22a-da6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765881279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881279, "uuid": "6009af28-4740-4a7b-9938-c12b37a8c33b", "comment": "Malware payload (Mirai)", "value": "244dbb944e00d19987d73040025f3da8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881279, "uuid": "f1eae76c-e83a-4303-836a-760ed2d045af", "comment": "Malware payload (Mirai)", "value": "d09e5e1e839aeb9995942ad7c250ff19bb3d2ebac871e4ce3e68fbc5f92ad4c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881279, "uuid": "e4523569-3e89-476c-84a7-aa1084d6904e", "comment": "Malware payload (Mirai)", "value": "75e4722c10e587096c0a15b7ae5a4fbb7ce449e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881279, "uuid": "7dac4747-43db-4f85-b3b7-ea498182fb79", "comment": "Malware payload (Mirai)", "value": "5145f0de717790e3b1fcd79043127069e4f7c133b2ceacfddc055d9aca0155c201f546c130d97114090e9c3be2353db0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881279, "uuid": "7d3ef220-e32b-490c-b01a-17ca79e78993", "value": "T126A32B46B9419F12D4D621B9FBAE404933536FB9E3FA3102DD20AFA027C59DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881279, "uuid": "ba415833-9ef4-4ee8-b8bb-3f9eba0dbead", "value": "3072:84+jya5WLWUZaKRnxH8aMwdDeH4+I/Qa:ujB2lZaKRnxH8gdTr/Qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881279, "uuid": "eeb28be2-3480-46a2-9d90-b5e32838a391", "value": 99712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881279, "uuid": "a55944df-ec86-4cab-8a97-406764174697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881279, "uuid": "e0eece20-d7fa-4bda-b634-a90da46a28f0", "value": "karm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6efb8b9-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916423, "uuid": "0882fec9-0165-4a1b-a031-6b1deb505374", "comment": "Malware payload (Mirai)", "value": "91e93ab2c44048e525a1166907819cdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916423, "uuid": "2a295124-28d3-471d-93ff-d96afe1f0999", "comment": "Malware payload (Mirai)", "value": "d0e69826172390416075ecef3feb17d339b41888896f3868f3d206da1a26bf85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916423, "uuid": "598760e2-ccb0-401d-83a2-78f174b46ce8", "comment": "Malware payload (Mirai)", "value": "6c95e487abe1f650250b98282d540b6374e8d048", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916423, "uuid": "737ab2cb-0ffb-4acd-9fb6-abba4d23a081", "comment": "Malware payload (Mirai)", "value": "b2cc01cf2a5f41bb032ce03bda7c2ab61cd5bc5a39d6364e3aba4922349ebe08f9df040b78dbde3494d84ca5263be8db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916423, "uuid": "4182b980-8d29-4710-80ce-7905fe76f790", "value": "T130E33C86EA409E13C4C61776FAAF514E3322E794E3DB33028D185FB43F86A9E4E57605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916423, "uuid": "235c9e2d-5d39-4a23-acdf-cf9556dbcce2", "value": "3072:DxRizSAt/6R54dO21MiF13bOjU1CUeY10M6NbyXap0kM/9dnr:DjizSO/6RSbQjU1CU7WMDXapnM/9dnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916423, "uuid": "0c0e2e62-32e2-4b4d-8965-ec7e6ef94c32", "value": 150354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916423, "uuid": "8ce96bb1-eb83-4c99-b238-cdf90ade5738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916423, "uuid": "14ec56d1-23cb-4c55-929d-8fbb2c50ea03", "value": "Fantazy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d38083-dac5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765920096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920096, "uuid": "bfd8f24e-6e18-4101-9bd2-499ad4f5d4bb", "comment": "Malware payload", "value": "5ac86ff6370e6b57c0dd18ad13f07387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920096, "uuid": "2ef0c025-9272-4ccb-a3c2-2abc3e02fa9e", "comment": "Malware payload", "value": "d1259b87f5af9da064a720cae1477537119fbc756d60a04d3679f0f32d380eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920096, "uuid": "a80a2fd0-4ecf-4894-984b-dc5149be243c", "comment": "Malware payload", "value": "e91b987b8f404a173a4075abf7b92cc1a0f40d92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920096, "uuid": "b7255804-db3f-4caa-942d-e75655d1f7d0", "comment": "Malware payload", "value": "a243a67f26b71eb6f09a3438c526da9b85ad11c6634498e85dd74851730e2bc45df42e886f3f6c99f9a3bdeae5e64742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920096, "uuid": "632c3673-2335-4f82-9e70-8f3b16b62987", "value": "T1D8E59D5EA2BD16D4D9ABD07BC907590BC7F1F8610236C39F01A48B5A9F376230E1E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920096, "uuid": "03363dda-3b5c-4827-8578-b28d30d58cd0", "value": "7183013bbe478f6973b2c54571c6c88c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920096, "uuid": "6233215a-b5aa-4028-83b4-4863aa11c98d", "value": "49152:ahsVgL4tW8W5MYAwkzAKgRCPVLi1baCzWOMK8rSUllk0aaY4egXCfuwZDPd43AFu:gCPRi1VWOirS+k0aaYMsuwZL234N7Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765920096, "uuid": "caae7143-8f43-4f68-95f6-cef2dc9f8e12", "value": 3231720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765920096, "uuid": "8c5de967-25a7-41ca-8038-6d9966c9a639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920096, "uuid": "1baa9861-0d53-4547-bf44-d661562e54f3", "value": "AI\u8131\u8863\u6362\u8138pc\u6d4b\u8bd5\u7248& - \u526f\u672c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b664d1-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765852782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852782, "uuid": "bac7dabe-770d-4636-8c3c-b6fe9da8fab1", "comment": "Malware payload (Gafgyt)", "value": "a6d7e6fec4b8bd03ef9c80670742d903", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852782, "uuid": "2c5f18ee-a96b-44e0-9f46-44b8e9244739", "comment": "Malware payload (Gafgyt)", "value": "d199b090c791820d6e40c7dffb34847421b544f985e2e05ef1b27785d5c1e083", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852782, "uuid": "9d8e38c1-c07d-47be-b47a-066176513cf2", "comment": "Malware payload (Gafgyt)", "value": "46084f06dcd834cc784793d39827ea307c0a6c47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852782, "uuid": "c3d41fb5-0873-47bb-a671-f8798105702e", "comment": "Malware payload (Gafgyt)", "value": "1edbf596953c24bd67ca53ee4381f82ef929b0b627731fc34c7bdc345eac2e09125b89e317f0816e0d39bc9c3675eebc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852782, "uuid": "c242cca7-76b8-4bbb-9cfb-c4235bdf08ad", "value": "T129C32905E450875BC2D2237AEB9E465D37336BA893DB33115A34BBB42FC27D91E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852782, "uuid": "2c28cc14-6ac8-4197-8f0e-afe126f0db5e", "value": "3072:5a5QDpDeRWa25UO1R1DLRUL4+mwQYY5QXhga:o5QDYWacX1DI4+mwQYY5Ghga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852782, "uuid": "d0d048fb-158c-4ac5-a6b6-39e9b0f3e1e5", "value": 123743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852782, "uuid": "7f89dbed-5d6f-4872-94f1-4430fbe8cac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852782, "uuid": "75db4f8b-16ab-4067-a22a-cdf328c73d43", "value": "Fantazy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde96fa9-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765880008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880008, "uuid": "cb7cd2d2-b915-464b-85a0-decaace90309", "comment": "Malware payload (Rhadamanthys)", "value": "a39b736176574ccc491ebc7c2ad715e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880008, "uuid": "e5212eec-6b5f-4f04-9725-bef8af7b9038", "comment": "Malware payload (Rhadamanthys)", "value": "d2520c9bf2070ba3b3901a54b66743dfc92bc32d5d61a0902a513901e6e1baf9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880008, "uuid": "d712bf8d-30a2-4706-a87a-18a7b9b97240", "comment": "Malware payload (Rhadamanthys)", "value": "bf71e69656bb0e91bfb6ea09c701883cca070b1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880008, "uuid": "5e09a37e-6983-464d-a82f-1db399b1ebf1", "comment": "Malware payload (Rhadamanthys)", "value": "a23e18da06e6cd620dba670406bb8c7e1e35be2d7e8faa6f95a8a7b484adb626a45a95c49793ee947f50aaa2a46c0bbd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880008, "uuid": "51f14efb-1879-4c95-b8db-a0d29272a9af", "value": "T1BAA3094A68628BFAB1A574A4AFD0886D9A0A3CC7D1331361451FFB61751CE8B6D313F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880008, "uuid": "bb4e1843-2ccf-4a09-b035-0d80ae8c5aac", "value": "768:GDhd0i7J4sYKgY/CMNfWdcz0Y/p4Mpq05nuSJpy/AV8jaGuA+HobZFkwNC3NpwMu:GDB7eKg208rzr2CyFnAfEy6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880008, "uuid": "df874ebc-8823-4670-94b7-c7a75a666795", "value": 102725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880008, "uuid": "b426d29c-a0b4-4644-8801-08367dd8b91a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880008, "uuid": "ed45d773-0254-4947-bc49-c7cba1e6b94c", "value": "invoice-1637482117.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0f2c17-da88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765893856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893856, "uuid": "3185f438-7ddc-4152-81c6-c2cfc6b0d86e", "comment": "Malware payload (Mirai)", "value": "8e7ad46ae99a0fdecbe7d61720e38210", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893856, "uuid": "a7afc59e-1357-43b2-8100-92c706e5ef8d", "comment": "Malware payload (Mirai)", "value": "d258b9e0c84daec04d039758807e978e954e1a39fcdeea2434c7210999e10e31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893856, "uuid": "219fe74e-0714-44bd-b8c8-c3351fcf7825", "comment": "Malware payload (Mirai)", "value": "b99b132d875732594443fd56f97355ff9a603a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893856, "uuid": "187f12eb-124a-4a98-a7bc-29a67652b4da", "comment": "Malware payload (Mirai)", "value": "1886e01efa334f6fd49471400de4848d521f9fe7da08a5a882817eea091dc422cf909153565aa78c391cb86452eea3c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893856, "uuid": "e62f89b0-7531-4a9c-a4df-6901c4c5eff5", "value": "T12EC34B22ACB63E37D0F079BA51D38232F1B5570810ACDB19BD720D9C9E7912837576BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893856, "uuid": "23e6d9ff-6618-4682-a561-0872a10fce3b", "value": "1536:ViwdXSLlbbhfH4nDEycw8TZejHVWv4MORo8L86mcGQtS3IWiiRUQ6LZFgAkA3XxG:VXMX04tiAcXr6J6YB0jABj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765893856, "uuid": "82c17f34-ebde-4aaa-a593-d23217ec4505", "value": 124244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765893856, "uuid": "e3fe7df0-ad4a-4cbc-bf5d-4bace999120c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893856, "uuid": "768a61a0-5632-478a-a437-645eef78e332", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e83844-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926924, "uuid": "2ec3878f-0d46-4b9e-a04d-d588a713706c", "comment": "Malware payload (Mirai)", "value": "f0301c03e1ce86150bb87ef0c7107d16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926924, "uuid": "75547883-5270-41c1-9134-b8dd42248e74", "comment": "Malware payload (Mirai)", "value": "d2a9192da21d74944e152f3170d79b7efae022c89e2def83a1deb7825dfa48fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926924, "uuid": "0b1b3626-550d-4123-b358-306b636614c4", "comment": "Malware payload (Mirai)", "value": "e791349970d77ae61e487665c3d088821ef34789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926924, "uuid": "d3a1cb55-7343-4bee-9bb6-e23fe28f5039", "comment": "Malware payload (Mirai)", "value": "5190752ca811d7985fa409dfb8f8b8095893b3abcc7a0f61a69d5a1f679d96ae0ba21c190e4d7e166953c0ca9f133f53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926924, "uuid": "48639b69-e244-4254-ab5d-cb50865bf639", "value": "T1AFA30996B3198303F0534EF56D3F27ECDF5C6DA029A8B74C251BE6480176C728986DEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926924, "uuid": "c87485aa-8402-4f7e-a406-2cdaa5d28126", "value": "1536:hnGZsMRi7zYQNh1y2GL96z5+dzIIx8nXYVR15TO2MBAg0ML:KsoizYQNh89K8h8nX25TO2MBAg0ML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926924, "uuid": "a3d9fef7-4b4e-44fb-b36b-c1c33366a9a4", "value": 101700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926924, "uuid": "1fcfe67d-9ddb-45bc-b6c4-5c02256a4458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926924, "uuid": "d475411f-793f-4860-adc4-c352d8af9c8d", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811d20a8-da14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765844204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765844204, "uuid": "f6ce84b7-07b9-4593-a7d5-0e8a34aaaf5f", "comment": "Malware payload (Mirai)", "value": "b2af7fb9299ab7c5609a0fa597a7200d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765844204, "uuid": "60b7af39-0ef7-432b-9afb-eae4f209af80", "comment": "Malware payload (Mirai)", "value": "d2e7ee8aac7364ffe8a5482f4c445898bd1f700303e642fda05b0931ab4d292e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765844204, "uuid": "0a92c05d-ba09-4d96-a8a9-fa741e90530b", "comment": "Malware payload (Mirai)", "value": "80e55d65c2665ea2a0ba8a903366f6fb0c1493df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765844204, "uuid": "247375c1-f557-4abb-b48c-8e55971dbc75", "comment": "Malware payload (Mirai)", "value": "6af1cf9ee61b8da0928bd27ddbcdb211bc81100cb4bad5cc484fbbb2d54917a6cd22475cddfeb185a78fe9c11f790c69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765844204, "uuid": "65b2f609-4386-4cd5-af74-bc9002bc2830", "value": "T170B35C8597A3CABDE8990033A0299F324B36BE3B0067C7C7DFF658315D506129A7876D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765844204, "uuid": "410aa017-93c5-443f-b48c-5f814dee9f7c", "value": "3072:66nhtzdlSPmb+N9LFg3b1nh8H99JIlFvLSoDS:6yhAPFje3b1nh8sBSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765844204, "uuid": "2c939cd2-c8f2-4d3f-bd32-c6e5e57f9bf8", "value": 117488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765844204, "uuid": "50f02637-cb08-45c5-b5c8-386c9d7724c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765844204, "uuid": "200f24c6-dcd0-41c7-8be8-47b30a23e720", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66edb03e-da3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765862629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862629, "uuid": "fad0b39c-dbb3-49ea-811b-b947645f32a9", "comment": "Malware payload (Mirai)", "value": "8c94149ac1fe9a19bb961820946830ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862629, "uuid": "b555d043-d644-4c18-94f3-ea1900455575", "comment": "Malware payload (Mirai)", "value": "d303d9870dd37712bb87a43f73efbe4d9b557c2285a1582539d086275d17588f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862629, "uuid": "cd8460d0-a105-4b9d-9966-2048fa8e6f50", "comment": "Malware payload (Mirai)", "value": "342c33518f95b6c4ec147b9f8841a461ea6fd3ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765862629, "uuid": "46bb1136-1d22-4485-a4c6-9c8cad894592", "comment": "Malware payload (Mirai)", "value": "8cde5d52a4099f67a904d395c76bbac619ea3a10bd15e9f9eaaac111932a954a0f7b8325bb9fbbc7e9bc9c85c41c7dd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862629, "uuid": "c690635f-303e-4528-ab74-f6f79aa73a8f", "value": "T1A4C34C17E9C080FDC8EAD1748FEAE136D973B46D1278711E27D8AA362E59E305F2D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862629, "uuid": "9cbba2b1-4981-47c6-99bf-903b44bb5ec7", "value": "1536:gHzIlBM7LQzcSRen1tLAD1rr1EczCXurkjKXfXtDoXZUEPr343Ix:gTIrCQzVRYk1rr1XCXMkCF+ZUEr7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765862629, "uuid": "18385cf6-8b0d-4ca9-b617-0a50e2666e25", "value": 122520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765862629, "uuid": "4157c6db-3bde-45f0-88e4-c0dcd52e9dc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765862629, "uuid": "0567ad7d-3dcd-476d-a187-e4a0da2d41da", "value": "nuklear.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3389f1cd-da78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765887024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887024, "uuid": "2f2bd6eb-85ee-4f31-81f0-4ade222ca1cd", "comment": "Malware payload (Mirai)", "value": "ca2326cc6bffd6643cef4c49d38be556", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887024, "uuid": "1766b840-96d1-45e9-aff4-bf017df11d2e", "comment": "Malware payload (Mirai)", "value": "d4430161c6ec31f865898ad227eaab62081bada677893ffb1e00dba1ff9daa39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887024, "uuid": "293d4c01-aa70-458a-a5e8-0c45d9910f31", "comment": "Malware payload (Mirai)", "value": "7f7b8825e2e75da292be0ae698026d2eb80cbefd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887024, "uuid": "c482ce1b-37d9-4f70-a550-67aaa9291af6", "comment": "Malware payload (Mirai)", "value": "e8bbbb0c881409019d1648430aa4ec371ab219af8364aaee63f80816ac1414440d9f1f973f81d0af3e14daa74591ea3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887024, "uuid": "af072918-24f0-4988-ab14-867fa53437b9", "value": "T1E2F3A60E9E315F7DF2ACD3B947B78B20DA69129227E1C970D1ACED005D70319A86FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887024, "uuid": "9c0fa7b0-9c8f-4ff2-b529-ec83ac1eed4d", "value": "3072:cbQiMKFbhWI6w6Qxof5C+zyHh1bii/Sw0r7K7Ror4+mHPvg/54+6sw73tBr/Dfpr:c0iMKFbhWnKIiOEy93K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765887024, "uuid": "77638561-c261-4c91-b22e-a0546bb12cda", "value": 159672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765887024, "uuid": "8f29976d-cda2-45f4-b8d8-a6436cbf509c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887024, "uuid": "445ec33e-92de-47c8-8936-eb2c2c540db6", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9658c2a5-dad4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926703, "uuid": "72a162e0-2ecd-4042-bd8c-bbebc2a555f2", "comment": "Malware payload (Mirai)", "value": "a0fa8fba9dd5b08f59688569b8ec0d20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926703, "uuid": "4ee2063c-c02f-46b3-86e1-8bd45ebe2a6b", "comment": "Malware payload (Mirai)", "value": "d46191d6c094bd6f38a1829044600fb96050a68c18b5e1e0517117bec4ea32a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926703, "uuid": "c7cd0ca6-d80d-481f-80ef-43a289a91d32", "comment": "Malware payload (Mirai)", "value": "8b019b1748a2d13e4a673e41609fc0e57986a67e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926703, "uuid": "95443a4b-6c69-4a67-8521-16e0fd59dcea", "comment": "Malware payload (Mirai)", "value": "5ce69027654721764ed021cba2982283f8e1b23992d4e8e23fa8df46aec383990056fd4b6820816480e0933d4f8cd48c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926703, "uuid": "4ef3f1f9-18a3-4610-ac51-511a629efc4b", "value": "T1ACD3A58EAF315F6EF1AC83B587B34B68DE55129136F1C584D36CE9205D70308A46FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926703, "uuid": "25a83754-fd06-4ddd-9186-f31ae8f43934", "value": "3072:o2ttkDYzVDFdJeIubiG/xNCc6enVFHqYFtVWqD+Tuid2ddzTZ5KOYk6CWGERteT0:o2ttM+vOEeLNYMJ7Faz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926703, "uuid": "e885869b-9af3-44b2-9391-588c83f2d0a8", "value": 135092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926703, "uuid": "2d170529-935f-4f88-94f4-f0af73acd1be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926703, "uuid": "987cb4c4-fc07-4586-8061-d096712e011c", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1838cf0-daa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765904818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904818, "uuid": "3ec63b12-dbcc-4ad6-b191-44fd016bf57e", "comment": "Malware payload (Mirai)", "value": "16d842462c48f6644c8687e106938e8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904818, "uuid": "66024e84-66f3-4673-a4f4-3bde6f1070b5", "comment": "Malware payload (Mirai)", "value": "d55da766c34505114e6bad65167b65a0bd2eda528d2055a84968545cf2a93f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904818, "uuid": "6c5e0cd7-3fcf-42ea-b188-2b6a0f5f1ad7", "comment": "Malware payload (Mirai)", "value": "8138a2af4ef23e7e5cfb58ff2d71c8760f3b07fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904818, "uuid": "380ed661-65e8-4b5d-b365-fa3b40bc4739", "comment": "Malware payload (Mirai)", "value": "d2932b7c099ae93f602bbd2a852cae8ddad392721e5f40c4d19820686e6e7751e18f708b28542f2c006ec2203d92b2b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904818, "uuid": "2eeb8bec-8d6c-41a3-907f-bf24c621d6d0", "value": "T174B3E65DBF418B10C9C163BAFE4B62CC371743D8E2EEB1179D146B65B78A1270E3A846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904818, "uuid": "2e930f94-6c57-45fd-92e4-28899498d1ed", "value": "3072:giA3nUPU8ZraCzxgukzv2jF0F9ppduxbQWVnp5e444vM:giAXUPU8Zr9xQz+6F9/dKcW8444vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765904818, "uuid": "03853918-1d34-4fee-9da2-fd9bed2b9845", "value": 107696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765904818, "uuid": "108a16a7-2084-4687-862e-587e2282f086", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904818, "uuid": "2db1a3f7-e787-493d-bd9a-00f8839eab5c", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2258b8-da94-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1765899173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899173, "uuid": "787a86bc-04e5-4fa6-8928-5876b8126228", "comment": "Malware payload (ACRStealer)", "value": "5b9b2880d4dd938594cf15055855526a", "object_relation": "md5", "Tag": [ { "name": "212-118-39-120", "colour": "#BC6232", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899173, "uuid": "eedf29df-6fff-4829-8178-b860944ce0f4", "comment": "Malware payload (ACRStealer)", "value": "d56621e8a3d5d9a92cd92ffcf02a3ba8b1441fd4073e6204e84641d406137f03", "object_relation": "sha256", "Tag": [ { "name": "212-118-39-120", "colour": "#BC6232", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899173, "uuid": "6c762ca9-3edd-48c0-9aa3-f9907db41aac", "comment": "Malware payload (ACRStealer)", "value": "cc9cb4375f35490d0d2a346f9bb748bddfd23f27", "object_relation": "sha1", "Tag": [ { "name": "212-118-39-120", "colour": "#BC6232", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899173, "uuid": "760176ab-2b2d-4d6c-a4cb-cb9f11314a4a", "comment": "Malware payload (ACRStealer)", "value": "5d7f2d9e025300e1576f5d1072509f6c53b58cede9d3443438598d3f51628943acee5b25a753cde3cc2ea0e472b5af4b", "object_relation": "sha3-384", "Tag": [ { "name": "212-118-39-120", "colour": "#BC6232", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899173, "uuid": "3e965a72-5728-4449-80a1-02d93709e2b2", "value": "T101C61295C9BA911BDF4EB6BEB0C981C2DDEACBCA1D61A807154C53CA9C964F007C731E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899173, "uuid": "e3b6068b-100e-4990-9574-1c76e4bdc0e8", "value": "196608:K2/jYJBGNJ4Wl+qn3z+ekFqgoJ5pqYuAafafgzMox3ydnB3j0AMW1:P0Of4O3KsdR4feoI3V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765899173, "uuid": "ce6b3eb7-5e15-4780-8fc0-ff041fcd24a0", "value": 12528488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765899173, "uuid": "5ddc856f-436d-4e50-80ba-9a29f20ee487", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899173, "uuid": "714ec5ea-5b4e-4b2f-87ff-4c1914f1a6fd", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9782c995-da8b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765895352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895352, "uuid": "57023083-9d83-4aad-b757-07c20b5bfa30", "comment": "Malware payload (Mirai)", "value": "d8ff53d9e6990c43516a70227932f241", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895352, "uuid": "422ce864-78ab-4215-8f8f-741699917e6b", "comment": "Malware payload (Mirai)", "value": "d6512a0738db84ebb3f5eb77fbbf1e2a6197144873aac447d8956e6ceb1d60a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895352, "uuid": "751ceab1-b2dc-478c-b887-533837cfb875", "comment": "Malware payload (Mirai)", "value": "f7b465de005578495c6db21ee5f89d0e3dc661ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895352, "uuid": "58e1d63c-3391-4b26-85aa-73bf11c70fb6", "comment": "Malware payload (Mirai)", "value": "003ec804b6d71951c7dcbf2555dcd1adb57c2f7553b1db627039657732395df5c70c68b0b2611a7802fe4090d4e71e11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895352, "uuid": "0987a805-c89c-410f-84b1-3646f3012373", "value": "T19AB36CD17108CD7DF88B93BB89770A16A954EA545F430F37A5A7FCA3A9230943D2ACC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895352, "uuid": "e207f969-8d1d-43ea-afb0-24cb9edb44fd", "value": "1536:wzYdF+bHMEsxWbbE+5BlqbuudKEpic8uqbIChxyeFNbxHNvTqPMLg:wzYdFTE0+Tc8EEVPyyNbxHNbqPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895352, "uuid": "cfd8bb24-1a25-4658-8129-f384acdf75b6", "value": 114300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895352, "uuid": "3c4a423b-2ccd-4dd2-bd8b-22e60012591a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895352, "uuid": "d197511c-251e-49cb-b913-02b97fa02aa5", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070cd1cd-da95-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1765899405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899405, "uuid": "c5acb4be-cf36-4188-84a3-981db121d397", "comment": "Malware payload (EternalRocks)", "value": "38e7633c9ea8923f7b154839ad32e2a3", "object_relation": "md5", "Tag": [ { "name": "144-124-241-181", "colour": "#A390FA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899405, "uuid": "9adb7461-384a-452a-9e09-7694bf5c7994", "comment": "Malware payload (EternalRocks)", "value": "d6dd03b80023d96768050a9becfec7b21e9fa32cf328d39ca30eef7fdeabb2b4", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-181", "colour": "#A390FA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899405, "uuid": "502501db-a692-4953-b8c8-8c9766a63808", "comment": "Malware payload (EternalRocks)", "value": "f4d4aab03d0728af9f593308b2b1f7ca407f73b8", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-181", "colour": "#A390FA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899405, "uuid": "31034410-92d9-4735-b451-c07647c3789e", "comment": "Malware payload (EternalRocks)", "value": "17c137f5a209508d9b4a3a6893c20ab1eb7acab06a0d599e641cf6374f8a184d93047ad5a0e9dbf8f3d343935be462f1", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-181", "colour": "#A390FA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899405, "uuid": "64abcd77-dd27-44be-b33a-802bd491eb49", "value": "T10AA63351E00210C6A77BFE16349B8D6E7797667CB5DA98B0C4BA84FB60C20CD23745FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899405, "uuid": "2d943086-040b-496d-8325-259456e2c670", "value": "196608:t6CCC0Oh7O6WZEsgZ7mvuDqwcfZuiyQWB25cU7CrBZF0eu:cPC0Oh668o9mvJjfZ1/USJCrBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765899405, "uuid": "913fb4ae-31d1-48ef-b21a-777afcdbee3d", "value": 9561255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765899405, "uuid": "a0f57a00-eaa4-4b34-ac40-a180d27695ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899405, "uuid": "d74a8ff8-163e-445d-a42a-ba204e46fa17", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198496b4-da71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883974, "uuid": "abb96fab-6e6e-4d71-854b-b146de186b9e", "comment": "Malware payload (Mirai)", "value": "31252c6f10b4461aed2484438a2bb0f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883974, "uuid": "2f9bb094-c45b-4ef6-ba7e-9e4d910c5d85", "comment": "Malware payload (Mirai)", "value": "d72778006d90f77d5b425b75d17b10f6538c443a8b369848438e7b477cb29cb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883974, "uuid": "7a14c700-4bff-47a3-8cb1-b2e4b51b95f9", "comment": "Malware payload (Mirai)", "value": "739308d65d84d09cd387c97d955eb6e4f458a8ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883974, "uuid": "ee480e3e-499e-4877-985b-d7497d22219d", "comment": "Malware payload (Mirai)", "value": "3d986ad3fad67f2e234f7933ecdbc8cd373339cebff257bd021f6273e338bb43ad4be870fabc0bf76707c5f4e9dbdc4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883974, "uuid": "beab1730-163f-45ae-9c1d-043c7cc5609e", "value": "T135B33BD27005CDACFD0F977A85674E0DA924F7529F428F23E996FD53A9220943C2ADC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883974, "uuid": "1f5a02fd-31b7-4b9d-be70-a7651fe00e17", "value": "3072:OoHtHMFEPZu5T5SUfghsttXJ+UafrZLMNM2:/hPZc8Qptt5sjZLp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883974, "uuid": "4d6e43e7-ab75-4d23-9a2a-b27ac8368ab4", "value": 117168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883974, "uuid": "bbd4ac91-6c37-406c-afdb-07a3377c91cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883974, "uuid": "c5cdff51-58c2-4871-b266-25e065ed63cc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007df2a4-da17-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765845277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845277, "uuid": "de9b8c70-f469-481d-8951-355e03ace4ee", "comment": "Malware payload (Mirai)", "value": "230687711a0715847c9feb7454cf8819", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845277, "uuid": "336e389f-1792-43d0-9efa-c73c6270725c", "comment": "Malware payload (Mirai)", "value": "d762b6d95be1c9a026b41412639c352c6b79554c7c3e5f5df1fcbd87d4ede37a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845277, "uuid": "83200e07-e464-4cb4-9daa-23ebf106a925", "comment": "Malware payload (Mirai)", "value": "e0a51e714c1d1a989811bcab652ab85d553ce79e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845277, "uuid": "207d7137-24a1-4582-b54c-cf6b8f4166fe", "comment": "Malware payload (Mirai)", "value": "fbf220ee88abbd961944ade1e696857878ca4092978a359e4732460dc80e06fbfbbfb2b043c596f71915e70ed93a767e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845277, "uuid": "a027c15f-38d8-4c89-901f-4feeef380b47", "value": "T1A6C31844BE45C613C6E7A7BBFBAE56DD3B1607E8E3EA350789204B6133870170D2EA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845277, "uuid": "296f6c3f-eabf-4bd8-ab96-4d215b315b3d", "value": "3072:BowqvnBmrINOz9/hWNztg7pDhexiSq8nR95:BoJ8Zx/WgdheJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845277, "uuid": "78ea7fa7-9be1-4ae3-aaa4-b47c622c0824", "value": 122304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845277, "uuid": "03168151-fb1b-4791-99b3-a4024d402225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845277, "uuid": "2a4f8b89-ba68-4fb8-9d0b-e1eea5fce2e4", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c555b2a2-dacc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765923346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923346, "uuid": "9f8f1877-468b-482a-88d4-900712195567", "comment": "Malware payload (Mirai)", "value": "e5ff90edfa8bf151fd806de16801a5b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923346, "uuid": "8baadb0a-6173-45fa-8b7e-b26e68d8e8bc", "comment": "Malware payload (Mirai)", "value": "d7abdc834a837dd5a2cb7a18e21ef1a9371d488602171553a90f74c2f9312829", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923346, "uuid": "cb313ce6-387a-45a9-99b3-c2232471a458", "comment": "Malware payload (Mirai)", "value": "ac1e484f5f078bab8b17f88059b5e537b7dd2da5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923346, "uuid": "c4cc49d9-c494-41be-a862-90042ffacb79", "comment": "Malware payload (Mirai)", "value": "753bb507ba35224b0a1385ab702a713c000aa1f23f1650355745f74dc3e4fcb24cfdd490b15cdee25d9671ca77d4b463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765923346, "uuid": "bda51ccb-47c9-4ace-8842-4ee45d5a76c6", "value": "T10D933A26BC747F23E0E5B4FBA2D38521F6659B0D14A8D638FC710F9EDD354202A5A1B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765923346, "uuid": "67022438-17e2-4532-947b-1948169fb32e", "value": "1536:zB5oSHDsANaTAdseme0eVWTENvue/jVN/xGgVerqbznNBVRJjyBkDp:95txUTupl/34W3TjyBk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765923346, "uuid": "0739ff3b-2550-403e-930d-5d2effff1d0b", "value": 94000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765923346, "uuid": "ae22a5d5-1a6b-40d7-a2b7-8ca6b1b39e49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765923346, "uuid": "44c990cf-c01c-4354-9097-6006d8637f2a", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fc8097-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905058, "uuid": "2fac9bcd-0d7a-406e-97ca-33329d05b647", "comment": "Malware payload (Mirai)", "value": "70ca12516eb6057a8ead834273a802b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905058, "uuid": "c7c1027e-3c36-43df-b4b0-0b637536041f", "comment": "Malware payload (Mirai)", "value": "d7e517b6cab772e2dcde7fa929b36014c1c6739a3b3cb63f8dd9da629bde6dc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905058, "uuid": "1b22269f-0c09-4af2-8020-bff98c58567d", "comment": "Malware payload (Mirai)", "value": "b8fba57b9905254317904e8ba5f3485346a3526a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905058, "uuid": "ea5ab295-33a8-448c-a230-1626eda26c92", "comment": "Malware payload (Mirai)", "value": "a2515ea4578c57b003aa68b40e6e93cc1895d1e9ed8c864f7ef022ccb2e2f32953e3931389a1b5fb8546970dcc3a6037", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905058, "uuid": "28c3a4c3-d48b-4950-b1d0-fcbe4e113743", "value": "T1C69319C37144CE7DF40B92B682AB4619AA34FE458F410E33E5B6ADA3A97D0843C2DDD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905058, "uuid": "b4d73088-d89e-4ccc-adea-aaeaebe0b7f7", "value": "1536:xEsIOc2I8yO+vBXnM6be8udXXGJcA0uBvtTrAKY/bML0Z:xE52I8yOKhnvgQcv6vtTU7/bMgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905058, "uuid": "0a621e53-5c02-4378-8a08-7effab584d7c", "value": 95384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905058, "uuid": "72c10618-2c9c-44a5-9130-5d91f9d51f43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905058, "uuid": "7226d9c8-36f4-4f26-806b-6766e4239cee", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dba1ef-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905302, "uuid": "3e54f0ad-26e2-4e52-aa54-8181cf040324", "comment": "Malware payload (Mirai)", "value": "9d0d3ad52c000e40d456baa719a094dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905302, "uuid": "5eb1ea48-9199-41f4-868a-ec01b7f5618e", "comment": "Malware payload (Mirai)", "value": "d8830c178b4a6decd70d5a1c03e09966481a7d4232ed216f562f42b582478975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905302, "uuid": "148c9386-a545-40b9-807d-f6d129f2e284", "comment": "Malware payload (Mirai)", "value": "d063c008edce15ea55e663cf31001c4edfc023a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905302, "uuid": "a28b1c4d-480e-4005-8618-68828413fa09", "comment": "Malware payload (Mirai)", "value": "87f7be25d5921ee65fb8ffa39ac0398beb484c16cd8a969c310e70b4d2b338262c673c9fb480af0447163a9fbcea05c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905302, "uuid": "ee067841-b16d-4b10-8e6d-fd75f12b84e8", "value": "T1E0C34B22FCB63E37D0D0F0BA51D38235F5B6570A10ACC719BDB20DDC9E395A4266627A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905302, "uuid": "355e22f5-833a-4bdd-aa73-77396b7aa19c", "value": "1536:CuWPhSjXloed4nPXerSy/+ZeVsVWE461kdcf2ZkPft03J7leKGB4SEbPgzd9/TuE:CNwv0OwLr1kakk6U9aUXZjABkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905302, "uuid": "1f567267-58be-4694-9ec4-d46fa8b0a812", "value": 124124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905302, "uuid": "eec4ace6-9986-481d-a91c-d310307952a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905302, "uuid": "146e9ba6-54d7-4559-9d6d-c0e85892926d", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20901c3f-dab4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765912762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912762, "uuid": "e226e53e-4794-4189-a9bb-2e8a7e3b427b", "comment": "Malware payload", "value": "3e1696d73e556b1a2e48097de3fbdd91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912762, "uuid": "8255891f-9c9b-491b-a01e-1adcbea64c4d", "comment": "Malware payload", "value": "d89261996132ba5f32b306c4fc8943f2f27e74fe55952e9c9cfc9a1f97d1658b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912762, "uuid": "1f8320d3-8d02-4f5a-8971-6efde5efb8ac", "comment": "Malware payload", "value": "12cbed4e46487069e5cf3a5cebed04b29418f673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912762, "uuid": "1b417e92-55e1-4314-95ef-dc6187048eb0", "comment": "Malware payload", "value": "a16169bc6d42a0f0b91602d9ae4f01e5ed928eac9f7583c927fa9f3153ec4fbd02e08503f01f1a97865ca178b9d90b3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912762, "uuid": "5240e9b0-6dc8-4353-831a-8ee0b1687c37", "value": "T1ECC30795BC42AB52C6D726BBFF5E02AC332613A4D3DE7107AC206B5A73CB1160E3E545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912762, "uuid": "bca96e7f-d9e3-45e0-b4c2-0566f58bc61e", "value": "1536:dGXmcK2Fm89lnwR3FC+MZ8zwzz+pDPGGbIy8gFJGbFOb2QyHvN8nXhVR15:dG2PbeZ8zs4IXgFAbAQPN8nXz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912762, "uuid": "5345dee1-11b1-4c15-b486-5c0a0b69726f", "value": 124096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912762, "uuid": "1dbd3e5d-6ff5-43c2-951b-7ec8bcaa6c02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912762, "uuid": "c76f0694-44c6-4732-b72a-8b8285b911bc", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15e0b58-da73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765885061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885061, "uuid": "6cf76647-396d-44d8-822c-4541a04d4e70", "comment": "Malware payload (Mirai)", "value": "857756538aa54e92c932030c930d3bf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885061, "uuid": "35c7bd4a-47bb-426c-99a9-dd10237e95eb", "comment": "Malware payload (Mirai)", "value": "d8b910dbcd5f852ef14f70bf20a525649097d35f7ac34f6ce2693e1b26274be4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885061, "uuid": "26fe7df1-58f9-4e4e-82bd-4afab8d9aa43", "comment": "Malware payload (Mirai)", "value": "f5bb16af9fc2b62f54aab538657f96b8a1de245b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885061, "uuid": "3c2eed65-b542-4211-abe3-4adacb0952a9", "comment": "Malware payload (Mirai)", "value": "bf7f35bff8b338407698694602fc1a241c9055240ab3df6be2b634fc008f86e17ea5a053532d76fc8ad35224ebf65a4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885061, "uuid": "bcdc8273-32dd-4d70-a169-36c366767df6", "value": "T105B33DD2FAD3D9BAE8250530202D57728634FA3D00FFDA87EFAA59705D6010286797BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885061, "uuid": "9d8e040a-29bd-4ae8-ae39-9cb98dee0f44", "value": "3072:juy7HgyyvdNv9YzBgdUYK1RQXontELjwaoDUBB4:jX7svTlY1gdUY2Qxgao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885061, "uuid": "590eccd2-4731-4cf8-b25e-6e1dc887de3e", "value": 116656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885061, "uuid": "a12aa4e9-1315-4f02-87a1-c9d7db8e5803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885061, "uuid": "cd563928-cedb-40e6-af1a-4afe4dc7fa6a", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7552f328-da6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765881551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881551, "uuid": "8133a06a-4f58-4711-a6c6-70966fd8050b", "comment": "Malware payload", "value": "8af4f985862c71682e796dcc912f27dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881551, "uuid": "d984e9b6-cbb8-43c4-87ec-738011d5deee", "comment": "Malware payload", "value": "d925204430ffab51ffbbb9dc90bc224b04f0c2196769850695512245a886be06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881551, "uuid": "62680fca-a4d4-41b5-a960-2335de3644cf", "comment": "Malware payload", "value": "7f83117abfeff070d41d8144cf1dfe3af8607d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881551, "uuid": "feaaa2f4-c9f7-4624-9848-a94f00b451f8", "comment": "Malware payload", "value": "fb442d97526669ad6cd675a1a08056f3262ad6cf109e30a04122b2c06f1fdf4feb4d4bbc948d492aedcb0bbfe822634a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881551, "uuid": "4316c385-0e45-49ab-9fcd-ce7f6078f3a6", "value": "T10F937D41F3E202F7E6F2053100A6726F973663389764A8EBC74C2D529913AD5A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881551, "uuid": "8550fb42-601e-4985-98a1-6314f44975da", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881551, "uuid": "2fb8a5ef-df8f-48e6-8ee9-cd3a41799377", "value": "1536:v7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfnweJbOC:D7DhdC6kzWypvaQ0FxyNTBfnBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881551, "uuid": "cbf2311e-946a-4226-84d7-fcdb95962748", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881551, "uuid": "c2ff7a36-f217-4530-aded-b6752e9e3fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881551, "uuid": "54b638f2-50b2-4d40-877e-f2c8a407a93f", "value": "43.240.65.55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7950e3-da73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765884809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884809, "uuid": "56c6b69f-4fc6-4706-964b-e5100bd630ee", "comment": "Malware payload (Mirai)", "value": "957e29410694e48f1b19d09f0868ba46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884809, "uuid": "d42baa6d-5270-42d3-8357-d427f8c70e0d", "comment": "Malware payload (Mirai)", "value": "d92c13f35741bdd364ff177b3f80e3a34906cf005fa839c63ef850bec0d29389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884809, "uuid": "bc84bd4c-bc84-4d5f-8850-8b3c30996ded", "comment": "Malware payload (Mirai)", "value": "104a9d60eb36d604f7c3cc978ee1423dfb234ba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884809, "uuid": "821e0a53-1a46-4d63-bce1-82a64b9e5cfd", "comment": "Malware payload (Mirai)", "value": "bfbb214598e1b48f6e8d01f79bf463332469924bffd49ec92ca5436178fdf2c7846c83a3f5899a1b4165da97d1f291d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884809, "uuid": "93ccfafb-db65-4955-9a90-c1810fca087c", "value": "T1F2C32A50BC41AA92C6D7A27BFFAE429C371603A4E3EE7107D8345B95778B0160E3E985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884809, "uuid": "52a55dd2-e3bc-45a8-bcab-ecb5310c0e83", "value": "1536:Y3+mdKsd5F8WPQesBly0DGjtzznAmZKwt+zPNCBMgUDSe0hsv/tSvU8ndo5K:Y31ANg0DGh7uzPNCyTDZuIVQU8nm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765884809, "uuid": "7242630f-6f54-4f43-a2d2-809b8906a724", "value": 121656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765884809, "uuid": "143bbff8-e653-4861-89c1-ef279a39ad3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884809, "uuid": "014ee7d0-1750-43fd-a41c-dd4b602a6594", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321e401d-da4f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765869412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869412, "uuid": "fcb3a185-8f62-4954-b69a-7d6f4267e9c4", "comment": "Malware payload (Mirai)", "value": "03a5c20ccf115d2d3ed38aac571658de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869412, "uuid": "320b7e58-9d9c-4a74-b0c0-de5f8727ef69", "comment": "Malware payload (Mirai)", "value": "dac2cd1f6cdf0b45c0f5655a42c2d2a9027f1db320050eb685fbbd015acb6af2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869412, "uuid": "c86a1291-6d33-449f-99b8-4f21f9444218", "comment": "Malware payload (Mirai)", "value": "59696861f6178f6413a974081109be145ffd13db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869412, "uuid": "2da01385-0a4c-4136-9080-4174364748a2", "comment": "Malware payload (Mirai)", "value": "0507a5f18d7a9d69dae16da61872d0b1904b48c59d8bb49396d65b93cf3d6a97b7ad0d281948705b18b95f2c7dccf08e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869412, "uuid": "481f860c-e5c7-4e0f-86ca-5eb23ebe15b9", "value": "T167B3F707BB60AEFBC89ACC3708A9871520CDD51771587B3A3A34D51C7A5B94F4AE38E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869412, "uuid": "df8da39c-2d5a-4a76-bded-7d7cc2ec79f1", "value": "1536:NbZf52IYXjResDI1ygrbZRDBOTgzp0+QdqX9GsPgV+AywxKrOKlA1q:NbZfIIYzMsYDAd2cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765869412, "uuid": "83f33ae0-e3bc-460a-beb9-12102f81115d", "value": 111899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765869412, "uuid": "e5c32c12-edff-4e99-8c8b-72c3a3ce1f73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869412, "uuid": "c3732eb0-6f3b-4275-b73a-ae8753b0503a", "value": "n3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c9e326-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879854, "uuid": "985ed235-880e-47ae-b4fc-acae50eceb65", "comment": "Malware payload (Rhadamanthys)", "value": "4b9c10e6c3b28b2d20b39ce417d752f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879854, "uuid": "056c82b5-6166-4406-804b-d380d40a5abb", "comment": "Malware payload (Rhadamanthys)", "value": "db1e65111bc9f41c4039beebd0d849edb7873dea4cec3505802c88cadd096f5b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879854, "uuid": "02e783be-a0c7-49c2-a7bb-3aa6d5cb7a9f", "comment": "Malware payload (Rhadamanthys)", "value": "c91b628edbf0569dfc46bb7e257150124bd85607", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879854, "uuid": "dcd13c64-e235-41c9-b477-8d30332ac46f", "comment": "Malware payload (Rhadamanthys)", "value": "46b921c859ee49f1781a987d385294b84049fa27befaa39c384170f2eb75d3c2b2e0e376f428d621853f6c8e008efa4d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879854, "uuid": "3aa52f4d-1866-4752-a2c7-e921ab2bed43", "value": "T1CBA34C081AC7CCEDAED1639E2C98ED11269D86D2701DEAF4418F3B39CA85F0695707E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879854, "uuid": "3ba1e518-125d-4901-a3fc-de542fd1042f", "value": "768:GDhd0i7J4sYKgY/CMNfWdT7O7P7E7e7N737+717b7u7772n7X7b7WxP7pn7nn7JU:GDB7eKg20K9rdrw4UvDALSM6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879854, "uuid": "c4271b00-5d47-4751-9f19-5067ea31b067", "value": 100673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879854, "uuid": "5702d52e-41a6-45d4-baba-0b7c53ee1a43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879854, "uuid": "c9b08937-1dc4-484d-8fe0-92deb22896d1", "value": "invoice-1637482117.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebe2076-da77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886828, "uuid": "f541b3b9-a772-4545-8e51-3ef639dd2ae1", "comment": "Malware payload (Mirai)", "value": "3c2c7c15f35d3f40498928be1d89acd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886828, "uuid": "ee797625-5652-4d0c-b69a-bbaf02a90948", "comment": "Malware payload (Mirai)", "value": "db49234e0434be0f4b35e62bafa2e7fc58002372c09880693ec85ea034fa55b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886828, "uuid": "ce9c819d-cb69-4715-a1a7-1f712189aef8", "comment": "Malware payload (Mirai)", "value": "f70ff9dfe150ab5513c78c3d99fe4ad59bffe5b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886828, "uuid": "34e8a203-1c65-4ac2-81e3-214c0cd946e4", "comment": "Malware payload (Mirai)", "value": "5d886263f159fbd9866df8549ade5738e13faaf82a582967e03217a621dc4ad9f638154d69a892f252131cc25c7bc2d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886828, "uuid": "707efcda-ae31-45e2-b26c-de6c97fb9669", "value": "T13DB35CC16001CF3DF91B963A897B4B19ED24F6514F920F27A993FC93A9221A43D2BDC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886828, "uuid": "b93eb9ab-39f2-4382-9b7f-2e2bda03ee86", "value": "3072:ZHMu6nkEP8siXA0k4gjdqUZDtl6jmMryyyHZc:/6x0LXk4gjV7kjmyyyyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886828, "uuid": "b02d8e1f-1394-4e4b-b0c5-8c5afba725db", "value": 115304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886828, "uuid": "ecc4e95c-02b7-4227-a610-8ca251b2165d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886828, "uuid": "fab1afcb-9659-4c22-a484-f9501aa9731b", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd97f71-da67-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765879824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879824, "uuid": "dcad1e5b-1241-41f9-9aa0-5afadefd58df", "comment": "Malware payload", "value": "34c10ebdddc89bd6eee5e3767bb88e81", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879824, "uuid": "5fe903a0-5ac4-4dbc-b360-82b44ac52099", "comment": "Malware payload", "value": "db5d30a1cacb787705927f3f14f9c59188c0803ce4048e537ab673fd6b1b1ca2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879824, "uuid": "4ba827df-c059-4a23-9057-0e228fb02835", "comment": "Malware payload", "value": "bddb2461a3d7284eb4f20b313b3b2b1b42094d02", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879824, "uuid": "0313fd05-25c5-4b4e-91fb-24100c4031ac", "comment": "Malware payload", "value": "8cba38a2b18ab71fd94b263644657c71b4ff6bffc65134a406e34c483597e5d523cff434acea2196bae0b871395fe20f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879824, "uuid": "c231a252-4c8b-417a-ad4c-5d8c4f917889", "value": "T158A32A4BCDBAD925405D6077FCC44E911D2EC8C182A2B0ED7B0FAB92D82EFA5D427197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879824, "uuid": "347934f2-7bf2-4698-a7ac-d4f89abf8937", "value": "768:GDhd0i7J4sYKgY/CMNfWduIFZArXe5rP3AhcbH59wXR67yAo6nSSloSLAuAAroQD:GDB7eKg20udrYrP3Wa2AyUo6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879824, "uuid": "aacf44ea-96ce-4216-82fe-bca9f140414a", "value": 100132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879824, "uuid": "6d92cf60-3662-4de1-8229-508b586c8780", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879824, "uuid": "0d03c26f-6f0f-44a2-9022-5ca6ff4a0ad3", "value": "invoice-1637482117.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d4eff1-da92-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765898304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898304, "uuid": "208cd1b3-f6e5-42e3-8d9f-ca1924cc9d8c", "comment": "Malware payload (AgentTesla)", "value": "3806b7a7a33b19ccdc63b263cd1488f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898304, "uuid": "fcda2f87-97a7-4801-8907-d6e5389e1494", "comment": "Malware payload (AgentTesla)", "value": "dbc2c3848d7b8d6024305318a36b42e67119a508ef3cb198c614f676ad2693d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898304, "uuid": "cd50c568-00fb-4507-87c1-526d028acca1", "comment": "Malware payload (AgentTesla)", "value": "e5e92ac7e3073d374f02f12fc6e40085dd7526e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898304, "uuid": "f8cd719e-c0d2-4a15-8bfb-138a0cbeec46", "comment": "Malware payload (AgentTesla)", "value": "a2ef668433d0db99623cea42b50f2c26bf11a02e4029a3b300d64bc6a99a7d929471ef36c01b41fab4d47d2d78590b7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898304, "uuid": "5151b397-cbcc-4f5c-bf23-704d829499bf", "value": "T198152320AE689E9F8C5CD33A10FEAF4AA7939FD5000A87D7330435418F94B56DFB1626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898304, "uuid": "7c72c3a9-99cb-4584-98de-6b5dc767a8a1", "value": "24576:BEGbV5oHWsgPT8rQGuoDVn9oRkvMC2EbPsNJND7Cx:B3VT8kGueOnEbU3Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765898304, "uuid": "d8a992f6-9a9c-4619-b50a-bf2a515a1513", "value": 926905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765898304, "uuid": "dfe8afb1-e161-47f8-90d8-012a3dfd60d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898304, "uuid": "70505a0f-0e68-45a2-8808-fd2e0b8ae5d8", "value": "dbc2c3848d7b8d6024305318a36b42e67119a508ef3cb198c614f676ad2693d4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc345292-da1e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765848652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848652, "uuid": "1cb5ff7d-2fc1-41fa-a805-fa37684a470e", "comment": "Malware payload (Mirai)", "value": "71af4feaf2196ac4559698f124e81cff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848652, "uuid": "017b74df-b9a7-40ae-b815-5682e7915bea", "comment": "Malware payload (Mirai)", "value": "dbd5c108cfc91754c8be078ea3dead7889bbf4b6209d01c52d18654f3e3d71d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848652, "uuid": "8d0a8e65-cc09-4647-a915-b0e5c822cdf6", "comment": "Malware payload (Mirai)", "value": "9ad3f69fb7374678e80857043943e5480b695bf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848652, "uuid": "9a928edc-ba7e-4f6b-bc24-64f7f046332b", "comment": "Malware payload (Mirai)", "value": "080af94a52c2ccbda3f89590b58f7951ff137ae8fa152f1cdea658b6bcfa6c5cc02535fbe9ed8e9fed1f15709da61c44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848652, "uuid": "6220807d-f12a-4535-bd63-f4bf23bf3187", "value": "T15562C689BC92DC1AC4D153BAEA5F461F3B10E39CE3CB3B07C9591FA0B50A6584E52A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848652, "uuid": "7efbac51-d455-4892-b202-9ad189a3028c", "value": "384:sEHCOStpXsyaj0YDXTYbFWPigIc3HuvI4606yVz9:BHpSrcya7DXMbFWPig6vIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765848652, "uuid": "cd7847da-83a8-4a94-b7f8-2fe54f73ef32", "value": 15856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765848652, "uuid": "575b73b0-eb28-44c2-95c8-e6580072a983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848652, "uuid": "71e44ebb-85a0-4850-bdb0-d27380096a1b", "value": "nuklear.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bc7067-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916416, "uuid": "6eade490-3dc5-4277-942a-39f72194015d", "comment": "Malware payload (Mirai)", "value": "18fe4d7e484830b9bc5f7c06a698dc62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916416, "uuid": "3494d992-2413-4786-8a0c-ea71521a6a2d", "comment": "Malware payload (Mirai)", "value": "dc9650fb46972e8461b462ed2e2c9ce6e90157c15743f63f1e977459a7b5bad9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916416, "uuid": "b415e6fe-7fff-4544-9bda-37ffd8c1c642", "comment": "Malware payload (Mirai)", "value": "bad90b0c7e3c4123b8c8cb6c1a2db7c3deb9491d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916416, "uuid": "838aace0-0a40-4cec-8740-70ed7b948f1c", "comment": "Malware payload (Mirai)", "value": "40c560932dd4eef2f676ce8debb8d3735f7bbe9939de370e489b27a5c90193ae062aba4d574885d32aa695da83f3c726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916416, "uuid": "b43fc14d-dc95-4fdd-bd32-1bae981465d1", "value": "T1BE634B0073588E07E5AA0AF9283F17E4C7BEED4011F5F4846A0EEA164235E735999FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916416, "uuid": "71eee4ee-fca0-4017-a049-36a25ba5bd11", "value": "1536:RlN6BrIbuOX19rk/4uEp9owhYA+kWbIiWyzN:RlNAhlw1YA8bTWyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916416, "uuid": "6e7dbd95-89d4-4564-891f-f9d16e726325", "value": 71064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916416, "uuid": "ceb9343b-91f4-4c3e-bf01-a18407c851bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916416, "uuid": "1edaa9c7-4a88-4087-a074-4e3828c7994a", "value": "Fantazy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bec80ee-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879683, "uuid": "452ce3f6-53c9-4bb8-a88e-e418a24146ee", "comment": "Malware payload (Rhadamanthys)", "value": "b9ddd76336099168da4f128162b12815", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879683, "uuid": "838f387e-84b2-42de-874f-c9a7fc6ca4ab", "comment": "Malware payload (Rhadamanthys)", "value": "dcb435269f37dce85baa836104d58972a6f8b69fefffb42d76d0c79437c371fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879683, "uuid": "2003d924-95fc-4603-96de-4ba34d751164", "comment": "Malware payload (Rhadamanthys)", "value": "9f8b7bccf3eff09161064ec8109be67f59b4cad2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879683, "uuid": "dcf732c9-b7c1-489d-8afc-578e84269821", "comment": "Malware payload (Rhadamanthys)", "value": "77de74749cd32873e9bf53058969dc51a0b6aca3742b260f6d2e4bcf4e417e4ea41ca61263c4f13298ae25a65deb51c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879683, "uuid": "783b7059-3d0b-467f-92e9-f75b9f53d743", "value": "T1DCA32A0ADFB3BC60A20190AD2E1496DEEF884541650BE1E50C0FBFDC436EB527EB5997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879683, "uuid": "71cca135-56df-4123-9f52-43313b184844", "value": "1536:GDB7eKg20Wm6mdrXrG45mbtmSnmymNmJARmEm3mjk/6BkQWJ+aY:GDB7b0B7XqOk/6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879683, "uuid": "837fd649-3e90-4b20-9821-0a5993386b5d", "value": 100735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879683, "uuid": "fbd0675f-34f9-48c9-a3a6-1516e072acd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879683, "uuid": "8a6537d6-8033-47ae-80e7-d00799e82237", "value": "invoice-1637482117.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed284e0-da1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765848039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848039, "uuid": "2eaeb30d-c56c-4be0-ac63-c4198b128a12", "comment": "Malware payload (Mirai)", "value": "dcf9d13867502f9fc09d7cabd5ff9732", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848039, "uuid": "0d2724bd-462a-47e4-9cda-f532cc6fddfd", "comment": "Malware payload (Mirai)", "value": "dcc31a1940030b09280489d069e48c93985d57058be10b4b12e142390b8e4a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848039, "uuid": "757203c0-1a1a-4e04-8b1f-87a84bb3eb0d", "comment": "Malware payload (Mirai)", "value": "b511ff9f0b01392292baf5a7d8fe62f96706cf2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765848039, "uuid": "8ab740fc-4290-43e6-a72c-997d57c26131", "comment": "Malware payload (Mirai)", "value": "6dd6ed6ca84d15706615800f572fc828bc8a00b47fda5b9a1967537d62bce788e8a1cfde215b158fbf7c17e3bc261641", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848039, "uuid": "9212f648-be3d-4505-8de2-1d19c5dbceb3", "value": "T175E30845AC418B15C9DB23BAFE5F118C335253A8E3EAB116FC186B9573CA51B0F3B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848039, "uuid": "1a230387-3576-4baf-a388-028238a7199f", "value": "3072:aBJU+lI3NSkrmvevn86ebkw3Ky9A6IuVmJfBzSNoVnI95:aBJ3lI9Skrmg86MkcKy9A6IqmJfxSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765848039, "uuid": "dfee05e1-7b93-4f10-8bb3-d9fea5e02313", "value": 143724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765848039, "uuid": "b5be21a9-6557-4684-a9a9-d793a5af1bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765848039, "uuid": "2e7f35b3-c82f-4b48-a45a-1ca145e0030f", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33a1009-da3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765861898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861898, "uuid": "4020820a-31f7-416a-8153-f9cf7681fe47", "comment": "Malware payload (Mirai)", "value": "195abfb95f3f1b26b101bde525746d3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861898, "uuid": "d18d086f-cc7e-41e9-aef9-21a9206b2c06", "comment": "Malware payload (Mirai)", "value": "dcd8956ccc32d9f28031ee7399713c718dcc391f35a436ead10cc9b52a95c3af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861898, "uuid": "a277dff8-0fea-42ab-a770-9a48a160283e", "comment": "Malware payload (Mirai)", "value": "9778fed79663affe4fed7c8272df82d395e9ca6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765861898, "uuid": "a1594b98-79ec-4542-b74f-14d665f50b99", "comment": "Malware payload (Mirai)", "value": "2355edf9754b579c2fe1d1a7482d2dc6c6b4b9fd520e6f8dc185e36887ad1aea0b3d9767df6310f517dd39463294582f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861898, "uuid": "2188cdb1-47f0-48ef-84ad-7eba822d66a6", "value": "T17BB3F885FC508B57C5C652BBFF8E428D7B2A1758D3EE32039D256F20379B9560E3A106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861898, "uuid": "dbeaa790-9e41-4dae-86be-977c2aa0a7c0", "value": "1536:Wo9aZ8UdZK2D/CSf4V8FG7uKPoPblTZwywGil/ub11VxnjkG4Ky+s0OXllvkl:Wok9dQDu4wG1PoguxxbCkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765861898, "uuid": "8905267a-6066-4619-8308-c0f794b811dc", "value": 108940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765861898, "uuid": "57751b1c-b882-42ca-b1d1-0b69c8a42bcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765861898, "uuid": "2647e45a-4b9e-4685-87a6-566a16ac209c", "value": "nuklear.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade98f0e-da84-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765892383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892383, "uuid": "82e564d5-4335-440e-915c-efb86b669d59", "comment": "Malware payload (Gafgyt)", "value": "e634408d574d0ee945ac2b58df8df724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892383, "uuid": "65a12765-3873-49ed-a8fc-169f9f7df821", "comment": "Malware payload (Gafgyt)", "value": "dd050b981f91e37f130b966b1866c3b8d6902549f76b1c96d205c0d97610d937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892383, "uuid": "c16e1854-851f-469b-9698-098284785257", "comment": "Malware payload (Gafgyt)", "value": "7844c1717ee93c0befc06e6dc2578e88cf2ca6f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892383, "uuid": "1a75e9c2-cb65-4595-9973-14cebafcc720", "comment": "Malware payload (Gafgyt)", "value": "94ca9650c46bad5c973b618491832c5a6c107dad48d97327aba6322a6ea7e5a57299c7478190d0b778624ea6990c77e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892383, "uuid": "e0f4c4ba-0849-4ccd-bf2c-6c25020a9444", "value": "T186933AD4EAA3D6F8E846057240E25FB78F34FA26016CDF5BDF695A30D840201425EBBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892383, "uuid": "9fa3f997-c066-4bc4-b1be-674e109a2ebc", "value": "1536:n123dqnV4HrsUjEoSzZSZVvJmOY7YOkKlSoDEUOXNMmBFJWl3tckhpJCQYGMSLGy:1230n6Hrs+EozbAOY7YOkKlSoDEUOXNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892383, "uuid": "17706c0c-1b9a-4d76-8762-9a96bdb812b2", "value": 90768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892383, "uuid": "d6e9ec98-05a5-4b7c-9552-2f3bacc63a28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892383, "uuid": "2a2c2f7a-da1d-4b27-8893-8c949783b404", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809ac781-da80-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765890589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890589, "uuid": "1e92d8d7-6acc-462a-85c4-6bfed01ec442", "comment": "Malware payload (AgentTesla)", "value": "87db86cd4ac7770338b38044cd617a3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890589, "uuid": "bd045715-79cb-4505-9279-37759f3006bb", "comment": "Malware payload (AgentTesla)", "value": "dd05e9f7daf7514a4efa39ab03e9056031a8e41cd1773419f62823b4f22e728d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890589, "uuid": "71dd3e55-d96c-41db-b8b1-30ba76b27259", "comment": "Malware payload (AgentTesla)", "value": "7da9d3bd29c3be1569c4f16bb65cdcfc0aec25b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890589, "uuid": "6a2a4bd7-998d-4c8a-bf36-327ee784f480", "comment": "Malware payload (AgentTesla)", "value": "10f31a259439c227ca2f264ed5c65ed01c406ac055969595972cbde4672bb17eb27cfd199fce61efba20dfb0d3c0d864", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "D3Lab", "colour": "#02D2FC", "exportable": true, "hide_tag": false }, { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "sender-jpnatliam-com", "colour": "#2A7258", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890589, "uuid": "15d28fed-2b72-4321-b3c4-9370024e3de7", "value": "T1C04502218D841FB9CFB89A1C90BE111DE3A04A8F542B754AFB3BBD46AFB7744411B0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890589, "uuid": "a0df242b-9318-4926-be50-59b6fb43b608", "value": "12288:vbndkjb9ppCKOxIuH1bkyxYoRmgI6cnzNlV4AZB5X+Ux+YUbmHs+v5LLSm9x4bCb:vbK7LCT6jlV46XXxBr9Lv9h7iOF5o74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890589, "uuid": "e85a2afe-d249-4b03-b96f-c98b4bfdb955", "value": 1249592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890589, "uuid": "621b0bca-430d-4fa9-ab30-1873049c8750", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890589, "uuid": "f946aa70-625c-4288-ab6a-d12de448b789", "value": "Prova di pagamento bancario.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a52759-daca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765922506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765922506, "uuid": "0482453e-0cfa-4246-9f34-34006ebd1693", "comment": "Malware payload (Mirai)", "value": "c9062ffbc9c8732cd823522a811bacb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765922506, "uuid": "4a195813-5e41-4519-bfcb-289f732b6879", "comment": "Malware payload (Mirai)", "value": "dd71c1f30b6dafa47794d6336f3e7a10d849ac4dbb9274eb6738d20f578eb1b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765922506, "uuid": "8ab7fcce-c3a0-4cc3-b1a2-6cd1943f850b", "comment": "Malware payload (Mirai)", "value": "82c3b40cb5c2e4e215a7c485b0cb8ee6fafe097f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765922506, "uuid": "675aaea5-0a90-4dcb-a2c6-8c908dc8af67", "comment": "Malware payload (Mirai)", "value": "8407b3e718dcac01be2da1f89ede1be430bc66c74c608368fb689190517c09b0fdf19e5eda7b0acb4eddbc009e9d0e93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765922506, "uuid": "5189a36c-f0c9-4609-9975-03982d9bbc2a", "value": "T1D0B38D31815D8EF6D2D84AB664A17D3CE322590131A77FBFBAE484D0448BDDAF02D366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765922506, "uuid": "12e854df-2069-4580-8f7c-c348a4fc69b1", "value": "3072:99dGGQ6375+SVh1+sMOYcwkLxOxMCiXV:99Db1+sMOvbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765922506, "uuid": "a755731c-7de2-4d92-9eb9-f66ad1d5cc5a", "value": 112144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765922506, "uuid": "8ae97275-7c8f-4245-99c4-e527fc233ba4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765922506, "uuid": "c5b7b091-d5bf-497a-9430-5ad41f99ef19", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483dccc7-da13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765843679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843679, "uuid": "cd725954-88f1-4de5-956d-913689841927", "comment": "Malware payload (Mirai)", "value": "e55b451bb0d84f016cbd8976cd8162da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843679, "uuid": "f6afc955-23b7-4517-9374-f462ab3b8029", "comment": "Malware payload (Mirai)", "value": "dd73a42aaa6582d49cab1ddab83e0a7b8e836285ff3b075972e45af8c46b5c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843679, "uuid": "d8383ca5-5d57-4553-9de5-7bc2c9e6e6a3", "comment": "Malware payload (Mirai)", "value": "9c91b4ab96240e0b8509ce1ca48ec54cdd17de8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843679, "uuid": "326f7f65-d513-46a1-9621-1e5ecfc16af4", "comment": "Malware payload (Mirai)", "value": "4c7ea1263bd873d99c30ac74bda9cf5deea4b881216daf3b06fe73526d879d0682da7db5d421636affe26a123093e4a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843679, "uuid": "28992984-f4af-4ad4-92df-528bebab18f1", "value": "T1CA93E7187F49CB52C6E857BFF77E12CD336667A0D1EA700B8C110B9673A701A1D6AB06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843679, "uuid": "07ea2acd-c821-4460-ad61-b455c924869b", "value": "1536:M6SGeJJraH/pelScs/PSoH8pqj3gaQjPMdSP6of+9NF/7pU3D5FRB0T7okdQPDYe:M6ZSaPSoHvaTEM8nF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765843679, "uuid": "d8c77417-9157-4e0c-b27a-143ce45dcab5", "value": 88892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765843679, "uuid": "2d0c3d21-7c18-40c6-bc41-1b3388d86dc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843679, "uuid": "901e96cb-c087-4122-8c20-607128616064", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f623fe6-da5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765876038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876038, "uuid": "28336bfb-d5fa-4357-a2d5-73a802d8d66a", "comment": "Malware payload (Mirai)", "value": "a3cd24f1538013c6a83f63b558029150", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876038, "uuid": "b403b517-e327-41e0-83ca-94515ebae3b5", "comment": "Malware payload (Mirai)", "value": "dd8e27dc522f86b3e0c4d4dcc4b2c1b2ad0721434c1e4f8806cc88d07acbd0ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876038, "uuid": "39d47f0e-10ad-491d-a706-774575791852", "comment": "Malware payload (Mirai)", "value": "cae0dcc1c679b442e8bb66cebd1abad1e31d1f64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876038, "uuid": "015738f6-0f99-4bd7-81eb-41896fd89e2e", "comment": "Malware payload (Mirai)", "value": "1954be5af96a2485756e954682d60f75d2f0fa3ecd216b029e7c4b49139f2a34a659a069f0d974307a960fb29b31b469", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876038, "uuid": "2cfa8c33-b1ae-45f0-a472-37e054a11c1d", "value": "T11F744C13B7024F62F91650710AFBC7A279EC21C31AB65DD5E3228B9C7F122E52C1ADE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876038, "uuid": "7625f2e0-9aa5-4ba5-8a41-699446560c26", "value": "6144:4LxuiXphdolw4wKUQBP24P+Zz6kLTa7J8FoaJ3BvM:gAiZ0w4wPQBP2fRWt8/xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765876038, "uuid": "112ded3b-5b1b-4a5b-83bf-aef4ccd64765", "value": 349648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765876038, "uuid": "61f3f5b2-a77a-48fb-b019-4758db26d81e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876038, "uuid": "8e37fce0-aad5-42b4-a919-481bd7e27726", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29163475-da2e-11f0-a129-42010a9c0007", "comment": "Malware payload (Floxif)", "timestamp": 1765855224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855224, "uuid": "90aca7ec-ea0d-42af-aa67-d83db84562ef", "comment": "Malware payload (Floxif)", "value": "7574cf2c64f35161ab1292e2f532aabf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855224, "uuid": "a6810bb2-0f1b-4c84-a92a-7bb8c312d24c", "comment": "Malware payload (Floxif)", "value": "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855224, "uuid": "c1825cd2-2873-4bd0-b242-cc86ac43216d", "comment": "Malware payload (Floxif)", "value": "14ba3fa927a06224dfe587014299e834def4644f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765855224, "uuid": "ceb90063-eafb-4808-855f-166a6f119723", "comment": "Malware payload (Floxif)", "value": "1bf42ad1b41c257d073c6ba8afa601ca2db897484cfc3f7dbb5c427c49a569ae96671e9b500887e02458b8c01d310a14", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855224, "uuid": "ebd6a5c6-acc7-47c2-9af6-05f7b98e1e18", "value": "T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855224, "uuid": "7896d5d4-c466-440c-8634-88ab69e30710", "value": "2f4ddcfebbcad3bacadc879747151f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855224, "uuid": "882f7645-ef22-486a-83ab-c8eed3a06bfc", "value": "1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765855224, "uuid": "077d8187-c66b-44df-b4c2-3437f9ad3aa7", "value": 69337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765855224, "uuid": "057df313-e9d3-4527-9eb1-4847ca8f6fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765855224, "uuid": "3f5fef40-3a41-499a-9237-a483a9450437", "value": "symsrv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0aeff38-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916413, "uuid": "9bbdb547-8488-4ad2-905a-2bc837efd7fb", "comment": "Malware payload (Mirai)", "value": "7c0ad052b19961d97546eefbb898ebd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916413, "uuid": "1e38e925-9065-428e-8e7a-c7daff1a0947", "comment": "Malware payload (Mirai)", "value": "de368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916413, "uuid": "a6081f7f-df7e-4152-a7c3-f658afa12444", "comment": "Malware payload (Mirai)", "value": "df21fba3436211ecfdc196ca407dc9116fde93b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916413, "uuid": "960692bb-57d3-44f0-85e5-f608c801c3f5", "comment": "Malware payload (Mirai)", "value": "f9fe43118247d91560e8569aebf0206553b0cf0ef620af243ac4c5587ffdbf096f698173ce203296c163989e5a92cb91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916413, "uuid": "382ad0b3-e9c9-4519-9145-cc1bd6023650", "value": "T121634B99B4018FBCF84BD9FA41254A0EF52162109E530F27B627FED33EA20A6DD47D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916413, "uuid": "2e1d0f41-0554-4cb5-ae73-42bae3263692", "value": "1536:6Zw62k7o8Pl92tktfMGL4hfQJRPB97Sl8pEvK:fVk7XPl92tKMGLkIF9+2EvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916413, "uuid": "10720393-3a86-4dca-bddc-63eb7705ecce", "value": 72728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916413, "uuid": "e7cf515d-59b0-4874-a1bb-4a35050bb9f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916413, "uuid": "ad6b6f92-148b-454f-8173-29422b15c403", "value": "Fantazy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a503720f-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879913, "uuid": "5364c566-86e0-4ec0-9022-a14a64f5e390", "comment": "Malware payload (Rhadamanthys)", "value": "be7835a8a4354afebf1b1d4bf968d321", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879913, "uuid": "99b3efd8-3d44-4fc3-b24b-cb1f52af8f72", "comment": "Malware payload (Rhadamanthys)", "value": "de52e1b753065bfe4b70055e9f71915d0536ca7253d74adbe46d4f679d0027bf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879913, "uuid": "b0fbe048-5485-47e6-b187-7ec71b0b9765", "comment": "Malware payload (Rhadamanthys)", "value": "68a5b7c7a4b6a3497536c7e278a7377dff2e189a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879913, "uuid": "d6a10777-3c2e-4199-bc7f-bfb841f1db60", "comment": "Malware payload (Rhadamanthys)", "value": "ec9df4504de15efe6ddda656ae95bc02ece75afdf89998dbe8d58d3498a3d2cc2c33586b5ee42069f06f6ce6c42dcd33", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879913, "uuid": "ef3b720a-0efb-4abe-a9de-25aa700290fd", "value": "T15CA3E624BE43FFFF1194A1FA1E8CDCD6D16C884241407B5A892AF77B8115B581E8DACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879913, "uuid": "5f5e38bd-d778-4758-a840-af0f962993e2", "value": "1536:GDB7eKg20Kc2rzrZNLymc4bRXAzELRAL6BkQWJ+aY:GDB7b0KcsPnLtc4bRKELRAL6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879913, "uuid": "c89335e6-3103-43c0-88ce-9a2394b37d33", "value": 101526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879913, "uuid": "967d5efb-ccfc-4d53-a597-a7cfdb4402bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879913, "uuid": "bd747c30-c238-4894-8c7c-6b368636deed", "value": "invoice-1637482117.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7e8aa9-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879902, "uuid": "e3318824-a147-4cfe-b410-41537564d699", "comment": "Malware payload (Rhadamanthys)", "value": "ebb7a26234541722d82c4b57806acdd4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879902, "uuid": "3172e5fd-35bf-4e07-9529-217800f3fee2", "comment": "Malware payload (Rhadamanthys)", "value": "deb3c2e0a003eab99e3cfee31fc95d7fddbee39ae45412ff0318378f75918205", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879902, "uuid": "9290603e-a95d-48d9-b217-12a1fd21067f", "comment": "Malware payload (Rhadamanthys)", "value": "52303bc327c5bc9dbf4aea5a829d22bec53a54b7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879902, "uuid": "ba0b662f-19b1-45c1-80ec-1c4e6b187e97", "comment": "Malware payload (Rhadamanthys)", "value": "9c37733614d5da02d8ba51b08eb37d5c4f47748a4c02ab9b27a42b3c40a856e1e1757d18bf7c22aa3a8afe8283eb7431", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879902, "uuid": "33a778b5-c75e-47d1-8529-a74d6a74a71a", "value": "T1A2A318381ED6CDB04082A11835D1197D858F65ECAAA910FA753F7BB01CDC6C3AA52FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879902, "uuid": "7aad366d-1917-46dd-be1e-b70dbc9be04a", "value": "3072:GDB7b0OSY2R1TwZB+Aw3SvFAlCsvWnO1MoN+bs+FZ35Lw3k3FkwwM73vdifOcljf:0KCNZIWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879902, "uuid": "b2980c82-7d64-492d-a4a5-5ddc11f5410c", "value": 98870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879902, "uuid": "987968c2-4978-49f2-8220-f6cbd070acfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879902, "uuid": "7beceac6-c12a-4ca0-8fcd-d75cacd83842", "value": "invoice-1637482117.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afccef6-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879789, "uuid": "946f6f2d-9c2a-4884-82cf-b7b193a637a7", "comment": "Malware payload (Rhadamanthys)", "value": "d16f15ef3848d6fd71c56a912cb7fca2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879789, "uuid": "3c4fc619-17a8-4454-83ca-cace7ea3c2e7", "comment": "Malware payload (Rhadamanthys)", "value": "deccec9e14fb829d3731704cbc322d3537b970bd428c069ff4585b45769ec896", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879789, "uuid": "4f5826de-8623-403b-b827-3171a3eeb5d2", "comment": "Malware payload (Rhadamanthys)", "value": "b98e9d67f5713e6c2628c6eaac2e68ef4e8d4f71", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879789, "uuid": "7353cc73-3823-45db-90ce-74ac60aa7862", "comment": "Malware payload (Rhadamanthys)", "value": "21e1a00dc5a661b9d04444d7b7de62db6e1628b7cc52a77c069611a4c4d06d7994b107cd04c8ddd36ef135d2e8b61176", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879789, "uuid": "e2686b49-7cb3-4df3-8368-f2715d76d922", "value": "T1BCA3087A1762ABF26CD472F62FDA5C680F078DE94F29041CD8D7B2E060BED11A4168D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879789, "uuid": "ce33150b-736a-48de-9d08-0916af6e7c7c", "value": "768:GDhd0i7J4sYKgY/CMNfWdKwWshrXF+rOh7xH9NA6123SLAuAAroQW+FF+Ec+0FO1:GDB7eKg20nrIrOh7HNA6Q36BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879789, "uuid": "4eafd9dd-0099-4650-9c88-e5cc9b1d94ea", "value": 98088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879789, "uuid": "b359a21a-ef65-4867-bb9f-e498360fc4da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879789, "uuid": "f175f4bb-5c4a-4408-8438-6303c10d6f87", "value": "invoice-1637482117.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f155945e-da7e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765889919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889919, "uuid": "e40a99fe-eb48-4d38-98fe-8dd8090a0f96", "comment": "Malware payload (Mirai)", "value": "43a1dda5b02155157763d2e35dd3b134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889919, "uuid": "0a41e235-19fa-4981-bec8-c259330c9b3b", "comment": "Malware payload (Mirai)", "value": "dede7ba84ed568f92057f73add97ae15fc654e2df3640f0ed5488678c78e03b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889919, "uuid": "32dd3c20-c785-46e2-a8b8-706fad28a12b", "comment": "Malware payload (Mirai)", "value": "ed1c8e78f619ecba8b49c4379165047faad4cc06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889919, "uuid": "c3b60e29-adcb-4e2c-a45c-b7d5cf94dec4", "comment": "Malware payload (Mirai)", "value": "985535f4b9ccdd55021d79205ca82b1553ede3c98114627fc719c0e6b226b15d6486bb06fba3dee31495e0cbe42d2be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889919, "uuid": "cf4bef8d-03fe-46de-8248-65d5bc29606c", "value": "T1DBB32A15BC419B26D6E32A7BFF5E02DCB3265394D3DE710BA8201B55B3AB81B0D3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889919, "uuid": "8ddf599e-e850-4002-b6f6-3115e842190c", "value": "1536:i1COy23K6vpZ5aIEy7o1BXEGzzd8L/MCfjkGRsWPCLzhFy/28nTo5:i15JDUBXE2CfjkGRsW6hFA28n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889919, "uuid": "4728e520-efcc-416b-a098-a31ee14d9a5d", "value": 117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889919, "uuid": "25577efc-a7da-4d8c-995b-d8b12948db18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889919, "uuid": "96878043-8117-44a9-bfe6-e718187652ce", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9649a80e-dad8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765928421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928421, "uuid": "617d347f-6d0b-4d0e-8b12-0855a37114b6", "comment": "Malware payload (Mirai)", "value": "dc50bb1bcb7b5a5c6153d32d3c6dd9ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928421, "uuid": "fa5f6aaa-7fe0-4343-845b-25179552d98e", "comment": "Malware payload (Mirai)", "value": "df329f035f75b73262f0b760315166900b97ae4dc23030cf8bac9c10c854dec8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928421, "uuid": "dcd18117-a812-4900-804e-c022bb9a7952", "comment": "Malware payload (Mirai)", "value": "d58439d6e502f465544a531ae687e36eba32b967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928421, "uuid": "d91e7fd8-ecf5-4d56-9962-d0238a6f59c6", "comment": "Malware payload (Mirai)", "value": "752617e9ca941bd76421e67c37c16d887276e49573aaf3e3e2e9450b38093050aeefd5cd64d22916c27256e666e80287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928421, "uuid": "b0abedf8-4018-48ee-8423-8ca84fc01140", "value": "T13EF3B50EAE219F7DF2BC937597B34F20D95A26923EF1C5A1E16CE9005D30358982FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928421, "uuid": "038cc62f-516c-4bf4-9738-0bd1e044fbbd", "value": "3072:QzuY3gHrniEclEut6lvu8J+DMxFLidcOezpDhW1VI+aVFOxemkYSKHQ6ZLxQGB9x:IZ3gHrqILrOAbecPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765928421, "uuid": "d4a57cf4-192e-47ef-9f4d-8cd32fb915e1", "value": 163788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765928421, "uuid": "9c939664-10d9-4c8a-9ecf-d390d226e5f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928421, "uuid": "9aa3d0cc-f317-4880-8347-290ff9c81c63", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf9ada9-dad4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926500, "uuid": "e5ec56da-0a7c-4c78-bce9-52faf66df75b", "comment": "Malware payload (Mirai)", "value": "d5c06474ea9cb025207e826166424193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926500, "uuid": "b3fd128d-0e33-4a87-ace7-a231804a6ae0", "comment": "Malware payload (Mirai)", "value": "df739fc942960d4623b5a8115020c2cd804e7c9370ca704651cabf773a83d39c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926500, "uuid": "e34fca59-6ca5-487c-942d-138f2933fd1e", "comment": "Malware payload (Mirai)", "value": "ed765a3fb072d66aae136a35f18aaf7e74c28016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926500, "uuid": "62b1a9ca-560e-49d3-9154-d1a07a691757", "comment": "Malware payload (Mirai)", "value": "27cb7f2301cc3968e2731ba68bc36a274630115ce46bddab38d2086dc77d44a4ee6b4a1d518075efbcdf373a5ff43b32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926500, "uuid": "42c4c8c8-0474-44ef-8571-ce5ba4e7f098", "value": "T10BB30887F20C8303F15A4AB56E3E67E88FEDE99011B8BB4D252B660C4577C365046FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926500, "uuid": "9d5d5c8a-3482-4631-ad2a-6ddef7c2e430", "value": "1536:oHddG7hBRoeXP4A527ckO+C66lagi2qW9GSJca4cnA1my8n1hVR15q:iGtZfT+WYgi9SJNLG8n1z5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926500, "uuid": "cdbcf566-7fec-4012-af78-71dfccc12c68", "value": 114452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926500, "uuid": "f20bd411-240f-4c0f-9f01-1c5c82fb2550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926500, "uuid": "39c47ba8-7b93-4fc6-bf52-887e33d1c08d", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a1f40b-daa1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765904821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904821, "uuid": "4c4757c3-e716-4cdc-8c7d-b7ee23322c25", "comment": "Malware payload (Mirai)", "value": "11475760325ac2ebc8dd04265b3687b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904821, "uuid": "655579e9-2d6f-4d12-96e9-b299bd0617f8", "comment": "Malware payload (Mirai)", "value": "df82e19b986567abe2b6c1eb263cf86f702f9a415adfdc8471e93400d2b50a70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904821, "uuid": "8b2cc2e5-6485-439d-8a9b-370d3206f171", "comment": "Malware payload (Mirai)", "value": "2ba3091a084f37f1e603efdf4b7615bf832013aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904821, "uuid": "4a483d37-1737-43f2-9f1f-46b537f03a86", "comment": "Malware payload (Mirai)", "value": "84ac3ae138a9f4f997329aeb68dff6a9aec3f3fb08db3c68be74355f1353a289d6ab9a9f862c5e1cac3fb9c82a20a648", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904821, "uuid": "ff285af0-5bbd-4e0b-bdff-f9eda7a60a17", "value": "T1AE54F70ABB610FFBE86BCD3B02E91B0228CCA44726E56B367574D518F55B64B0AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904821, "uuid": "d0c1f2c5-a695-4029-8342-adff8fae1e9c", "value": "6144:tWyMbd6nUO7yp3KJZWfxjJm1/B56lcsx0tJxHaSJ5UPjv:O99xjJm1/wcsxCaF7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765904821, "uuid": "1b31c00c-de8c-4abb-9c4f-a915bad44ca6", "value": 293572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765904821, "uuid": "83b81209-e0ad-4304-8fb3-c360c4dc7b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904821, "uuid": "6112060e-67ff-4f46-ac01-19e5794988dd", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abaddc2-dad5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926925, "uuid": "c4887dde-3d59-4f09-abc4-f2cae30e6128", "comment": "Malware payload (Mirai)", "value": "0f1ea5f758ef613227477673d34758d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926925, "uuid": "b3c2ae51-9fb9-486e-a75d-0c83e488e582", "comment": "Malware payload (Mirai)", "value": "dfc1f522341df6a7cc0f13f6c890c95a9e1b094d4466276400592b8e310ac1d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926925, "uuid": "30309ce7-e843-4bf4-9269-0f07acabaf30", "comment": "Malware payload (Mirai)", "value": "fffa5a482a74fcf4ad4213a3907b776ba6944260", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926925, "uuid": "b5fb42d1-41a3-4482-b976-061865b87cc5", "comment": "Malware payload (Mirai)", "value": "0a7ee490bcaafc338c1b88f84cc1575fcd7e96e205f003998f1ffe5886a0662653ccf4f79824a393aa9f4d30fd473095", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926925, "uuid": "ac56cfdf-a4ec-4733-90cb-a0680fdd4bac", "value": "T1E8932A147E419A36C6D8237FFE9F035C33765394D0DE712BEC20AB55B3AA0162D3A91A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926925, "uuid": "532fcecd-2393-4430-aa0f-dfbed5c12e69", "value": "1536:kduGKKApsFsSmBL3K1Wc39eMzzoRSkOzN8nF5:kdV18c39/08kOzN8nF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926925, "uuid": "92e2c653-bcf0-4b11-a9e9-d74b5dfa3be0", "value": 90012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926925, "uuid": "54fff3e9-4402-4a6c-908b-9a6f6c370d0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926925, "uuid": "f5133dcd-6ad2-4ce0-8af9-7bff17947f0d", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc842200-da80-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765890690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890690, "uuid": "849967aa-51b7-4f25-8c1b-4ed53ec77236", "comment": "Malware payload (Mirai)", "value": "fd1f845d4a2315b91a34c1d62eded373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890690, "uuid": "cd8e8f8c-70b4-4884-ad71-a74cb09ba7c0", "comment": "Malware payload (Mirai)", "value": "e04367d8cd9d0e990935fe6f595673ca6ebaa3a4e1c2bb1187fabd0c35a1c01a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890690, "uuid": "b4421c88-b363-4d0a-8fa1-c14894b28d0e", "comment": "Malware payload (Mirai)", "value": "4eb80a8a7f38df9018aa0915c67fd57dcc904662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890690, "uuid": "68fd7aeb-5656-4a3a-bdc8-213bcdc1be25", "comment": "Malware payload (Mirai)", "value": "ae7537fc977183220eacd2e6366ea2c7803374a5ab9d26e5a7fe608e4edce899abff4e42ff69d2894c6d7717ae0356f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890690, "uuid": "591673aa-7518-43c6-826d-569dc99981d3", "value": "T108B3F695BD859B26C7C7227BFE6E339C33261394D3DE7106E8202B55B38B1960F3A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890690, "uuid": "0714895b-2b7c-46e2-a8b9-45b7df03900e", "value": "1536:NZI2VC5xGHZwjj1Uwe+TiJ12zz1rFVGcx8ziVFLOurXNI3SvI8nTo5vXXXy+h:NZLAI+Ti/GBxIziVBOurMQI8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890690, "uuid": "e73fc933-469f-4463-9e32-741d8e9dbf38", "value": 115904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890690, "uuid": "b32f8eb0-6d10-474d-8890-a6356a1c4d84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890690, "uuid": "b6e15d02-dfbf-40cb-9c43-4a0246bb9070", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab61100e-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879924, "uuid": "8052cb0e-a728-4fda-91f8-8dbaea9a15df", "comment": "Malware payload (Rhadamanthys)", "value": "d7c2d61890c75354e9e22286f387723f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879924, "uuid": "76fa4e14-edd8-4a0a-823b-e3f02512e26b", "comment": "Malware payload (Rhadamanthys)", "value": "e072e2feba985acbd3b444b78d9fc98efc8c1a5a85c7018d463fd342a7410dab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879924, "uuid": "b943524e-0cde-46d6-a134-d521c0d95897", "comment": "Malware payload (Rhadamanthys)", "value": "6bb007a944e631a4b31c042e788a40e21ae79974", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879924, "uuid": "4e4e72d5-911e-4174-afb3-d3a41c14c235", "comment": "Malware payload (Rhadamanthys)", "value": "d6b856ef6446fcbc71b61b040774968906416a0257a719269082ff9e1960be061b73795171fba1df082a57fb98ff7898", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879924, "uuid": "033a0ad4-9dc0-4433-8a4f-7994e6ec7091", "value": "T15EA31B0CD6A3BCD348FB7C978E3538684579441916E62085601CD3E8A3FAF2566E68FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879924, "uuid": "5c4b1603-8359-4464-bb96-36bb0112640a", "value": "1536:GDB7eKg209vn2/EklQnDmBGlR+SHZJ2q8+KADAU63Eqfjqe4nIB3jHr1MCrz94Xe:GDB7b0A0/uA156BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879924, "uuid": "fffb0813-1606-4e85-9efc-570346262b88", "value": 99994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879924, "uuid": "559510ce-60c9-49e8-8835-61c7a505ed93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879924, "uuid": "88b91a1e-544e-4c43-be6b-1c6a563382f9", "value": "invoice-1637482117.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59fdae2-da95-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765899671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899671, "uuid": "515daf35-2119-4407-8c2f-60a4012a2b59", "comment": "Malware payload (RemcosRAT)", "value": "a96db373f74ba93f1bad982b548b6c7c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899671, "uuid": "b074d2e8-de72-41a8-92f8-9ce41e362118", "comment": "Malware payload (RemcosRAT)", "value": "e0a69eff836709cbefee1079d647d50d55f558e5f8c7bf18a8056361cd5116f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899671, "uuid": "c6d2fdac-5aba-4d48-8a5e-1629b1fedfb7", "comment": "Malware payload (RemcosRAT)", "value": "99086a78e5b794959ddc5ac3d390f34d29695b68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765899671, "uuid": "5b9bbca5-bd9f-44c0-8937-4b550bc3560d", "comment": "Malware payload (RemcosRAT)", "value": "dfd96dcef8c3737f8f1eb121b5405ee527a87868751c8fb08c8ba89770f0f747d65c4dcd35bb8e39686a8d1887d06d81", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laboratery-ydns-eu", "colour": "#6F93FB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899671, "uuid": "e7b5779b-76d2-4a63-9d8a-90a611b8e49e", "value": "T17896A631329510B12CA38C5B2E65C1919C27671BE869C42CF3DA31DAB7ADE34CE39E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899671, "uuid": "2944f98a-c0f7-43db-a21a-3e1034355fd4", "value": "24576:jngxqllUERiv4SO5yDo4iP5v8GwRKbKjE8oQsHDkzwA0rAk0Bv6XS5MXICpee4GM:XoLC2Mi9uqexFVJG82v6v5AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765899671, "uuid": "35041bfc-ad3c-41a9-a0b7-b54d0a313cfd", "value": 9272413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765899671, "uuid": "d5fe61f7-f525-4f4c-a428-6efd4338389f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765899671, "uuid": "014459a5-af84-4a3f-88cd-1a09cd7cc1cc", "value": "ZECH_GROUP_SP_PROJECT_ RFQ_SPECIFICATIONS_65438 (2).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88614c52-da75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765885878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885878, "uuid": "65054c96-16d7-4951-9526-d11ddcab998d", "comment": "Malware payload (Mirai)", "value": "b9f130d1c4f4079eb094e919f5332e2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885878, "uuid": "9c749439-f6b0-45d1-956e-82a0bf5a9d46", "comment": "Malware payload (Mirai)", "value": "e2372ead553da08363ef2e40607af6d1788fb44aa028cf8bc6a1328443954637", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885878, "uuid": "d202b707-5258-4ae8-a93d-c31822dcb59d", "comment": "Malware payload (Mirai)", "value": "6004e50a6cae559d5ffb48646fb4732f3791cd8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885878, "uuid": "7d2e013f-bf6d-4968-ae22-79a2d1359283", "comment": "Malware payload (Mirai)", "value": "ab8053b7995606c36d6ca1608313d61265ac4d6cff29fd290069b614d82452d16a1382070303b52b4fdca8293ea24654", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885878, "uuid": "ab448239-8605-4578-86d5-d9afe5b66170", "value": "T1F8C3188FB7184753E0424EFA6E3E77E8CFADAD6050B8BB4C241B660D01B6C365445EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885878, "uuid": "def3058d-5c79-4c3e-9b4e-c2ae54be41ad", "value": "1536:Sk9ZbePC+k1wRz88zisUCNAXXT8sso5mWHLxTy798ndo5l0Al:35wRzziWNAZsXIm8nm5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885878, "uuid": "76899a54-45e9-4e2f-bec6-68f5bb70074c", "value": 120100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885878, "uuid": "85bcae56-531a-423e-b2a3-c63e97aad9dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885878, "uuid": "c8b9ed64-0aa8-4b8e-927f-e2566446b282", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3fb786-da93-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1765898932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898932, "uuid": "0ee04213-e8e0-4180-8f66-5218e3a0edd0", "comment": "Malware payload (ACRStealer)", "value": "3d4e5bf09ced1c745a6129daacc7bf22", "object_relation": "md5", "Tag": [ { "name": "193-33-195-12", "colour": "#AF8637", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898932, "uuid": "66217cdd-4037-445c-8b31-d63b4bcfef5b", "comment": "Malware payload (ACRStealer)", "value": "e2ad9332eef91e4b89ecbbc2ed2942e49be6a6668d6cbdf4fca710c298c2d9b7", "object_relation": "sha256", "Tag": [ { "name": "193-33-195-12", "colour": "#AF8637", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898932, "uuid": "c1ee4142-65d4-4388-b7ea-482fa68daad5", "comment": "Malware payload (ACRStealer)", "value": "ceed5eb05b0056877e488da95dece1c5cfdd6fbd", "object_relation": "sha1", "Tag": [ { "name": "193-33-195-12", "colour": "#AF8637", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765898932, "uuid": "19f3a8c1-e196-4ad9-a031-4d5c541b5c98", "comment": "Malware payload (ACRStealer)", "value": "1f3877eca73e123dc81f4efc2be5b1a41a0e2493504549dc5b69ccd79970962b3776769f0b5326b1e5d766235d0ca9a8", "object_relation": "sha3-384", "Tag": [ { "name": "193-33-195-12", "colour": "#AF8637", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898932, "uuid": "a631fb82-a208-418d-bc51-bdf76a681f80", "value": "T11745230A23E0516AF07957B954FA43A34A313C62477486BF12D9E97F9F339C0A432B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898932, "uuid": "ab6a7f47-c38d-4dbf-8344-18f1dbf49b9b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898932, "uuid": "c31482b0-a8df-4f7a-8f06-7902e4f728bf", "value": "24576:utyZidneGpeYVK7Zgruo0gAnjZzser+gKXItPMZeU6dKpHCD:l8dEYVK7ZgC9gAnBHSgKXgtLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765898932, "uuid": "7d56c4ee-0a6c-4441-bb97-11386893dc71", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765898932, "uuid": "61012016-4415-4f53-a026-4d98362478e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765898932, "uuid": "56706971-4a99-4e99-be07-9fda4628b3b8", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d59749f-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883175, "uuid": "2721e468-9d8a-4632-8b1d-d9f537ba0669", "comment": "Malware payload (Mirai)", "value": "a5ff192df1ccd809504b6d14c5a91012", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883175, "uuid": "bd6f75d0-fe45-4019-bdb5-1f1aec9fa11f", "comment": "Malware payload (Mirai)", "value": "e309d4f6738a7d3e3c168582c2c275693be6fe0a13ff482b4089bc1527ad58e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883175, "uuid": "c2bec4a9-d807-49b2-97ca-19a14d89bc20", "comment": "Malware payload (Mirai)", "value": "8d05e88ab1339866f6a4dee4758f69af40af3059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883175, "uuid": "48acefca-abab-4f5f-9ec3-12368b40f154", "comment": "Malware payload (Mirai)", "value": "4dbfe08b84503cf07906784b6e1b0f42e3ab9f07a8d1c8ca7cd903a7beb8b4b568be19c7779a317205c4b57982e9f60c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883175, "uuid": "02ec845b-5ba3-4f0d-9c9c-86f1123213a8", "value": "T1F9D3EA0C6B624EBBD4AFCC3745A94B4918CD518332793B757974E504FA2A18F0AE3CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883175, "uuid": "05c262a4-a518-4578-9da7-f672a63ddcc7", "value": "1536:INqPKnrFT9la6FZ0pPks6KYBEzX3X072rDbc8VksbmUxNtDxJI08nX8VR15y:INHP06nQtE8eYqy/xb8nX65y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883175, "uuid": "ed4e2d1a-93f0-47b8-b1af-b05724b64c1d", "value": 135136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883175, "uuid": "e8303442-f724-456e-b0de-ef39fbbeb0cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883175, "uuid": "616fd6d6-867d-4964-bb56-446f55e06ede", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7701b8-da18-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765845941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845941, "uuid": "bda45e03-edf3-4f8b-8fcf-cc6c3cc84acd", "comment": "Malware payload (Mirai)", "value": "3b726f4c0db1cfb34bda93434fcba112", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845941, "uuid": "9a0a0dc4-e855-4f44-898d-e99fa0eefe7c", "comment": "Malware payload (Mirai)", "value": "e3140270c8d1153ec48a08176b8349612ba2e80c801dc34a1b1f9b68d49de1c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845941, "uuid": "671d19de-045a-4e73-9e3d-f18564cef666", "comment": "Malware payload (Mirai)", "value": "8b3598b315ea0a80b59ba32032fb7667878bdcea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845941, "uuid": "a5cf51bb-6399-485a-a672-0e9b0018c202", "comment": "Malware payload (Mirai)", "value": "80702930d045247dda1f20d9d167a6f652559a0f5a8652cd52bcddb3213370e2f813c1146aee5b8b99df595b9b3a4215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845941, "uuid": "29091eb0-b3e8-4d29-9a33-d92568319b70", "value": "T1D1F3C5097B605EBBD85BCD3701E88B8A188C955B31B83B357974E504F65B18F0AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845941, "uuid": "f55e1643-e77b-4641-8c15-e59017971dad", "value": "3072:TsvGXedNcoZIzC1eCdtvDhJVqa/8nR95f/WV:TsvNb4S5tvDhJUwwWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845941, "uuid": "077f96ea-8b38-42c6-b8cd-12275af90dd7", "value": 159720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845941, "uuid": "022cc33a-e7cb-4bf9-a4e0-9166428fa211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845941, "uuid": "7368073f-0780-48ff-8739-692f7971ac47", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc60413-dab2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765912167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912167, "uuid": "225f7b7c-4141-4c13-8a72-413ad7d2a481", "comment": "Malware payload (Mirai)", "value": "096114265afaf6e65a31ea7bd1f6cc00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912167, "uuid": "d602a894-65c6-4456-863a-2d61ba107474", "comment": "Malware payload (Mirai)", "value": "e451c22c07ab616b45449417e6142e11fe2454f5223fc5add4e9333afbd91287", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912167, "uuid": "adc54ee9-b8cc-490e-9c20-e4fc21b3e526", "comment": "Malware payload (Mirai)", "value": "d73974ffaa1c2c0c9b51901f3b232ef77eb93f90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912167, "uuid": "e4a72993-3408-4349-8921-35e86c2060c8", "comment": "Malware payload (Mirai)", "value": "b9380ee5aabede64142de43372715e44d06be7dab6bbf9313435dd0b04c28fb3071c0841ca631f4bc3bb039cb5a840f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912167, "uuid": "eef04bf5-b8a9-4a43-8d4c-c94d58b16659", "value": "T111C34991EE82E4B9EC050478707A5737CA34FB35011BDB87DFAA9D70AD81201D669BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912167, "uuid": "eefeb151-8d06-4d31-bdd4-31b3802e564a", "value": "3072:TxPZ2UaYkNS5QoytIr1aJXJCQFwTvisLKKPQjOMUOvoD:dh2Gp5FG8IXJ7FwTKsmKIKuvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912167, "uuid": "89f4b59d-a708-46c8-92d5-8aac8f696eb7", "value": 119760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912167, "uuid": "ee65f6c2-9223-4886-815b-f322edf5224d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912167, "uuid": "94f10868-c4b6-4f5b-9320-6b61f19f4f47", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a39868-da1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765847868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847868, "uuid": "567f21ad-7417-4c51-9201-8f9d242c9296", "comment": "Malware payload (Mirai)", "value": "a6e49dd1f7760e52496a18826121b460", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847868, "uuid": "887ec898-df30-4f0f-b2da-654be342c0f4", "comment": "Malware payload (Mirai)", "value": "e456dc4b9400943ff49ff9b64d4826d452f56369b34c1598168bf2ac10d9511e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847868, "uuid": "82c7468d-8ac8-4e31-b042-0254492c4c5f", "comment": "Malware payload (Mirai)", "value": "4b311a6a272d236da119757291bc23547fb9a5c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765847868, "uuid": "ad5ac70f-95c7-470e-a0e3-59ac54a93235", "comment": "Malware payload (Mirai)", "value": "3827017ba922b5b77ca8cc0356d4611411ed7d5b6bf3e353a597026da4800637af7112302c53fea854798a6aacc9812c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847868, "uuid": "257275ec-451d-4f14-a0dd-ad0c9408ea95", "value": "T117042A46FA404B13C0D627B9FADF42453323AB9497EB73069528ABF43F8679E4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847868, "uuid": "4d6c2087-6138-4780-8d04-80c7df5ff566", "value": "3072:YkjMAhjlvbAmfkIaboVSyck5z/HS0BpK2/1Jso0M/RnJv:NjxlvlcIaboVS7kVdBc2/jx0M/Rnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765847868, "uuid": "47ca77fc-a726-4e64-8979-c83aa1d439d9", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765847868, "uuid": "a27cdb9c-b2bc-4f3e-86ae-004639804dc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765847868, "uuid": "334ae8e5-1630-44c1-b2af-5509f5f93347", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55db095b-da4e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765869043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869043, "uuid": "9b1252dc-8f86-404a-81d0-55a0f7905afd", "comment": "Malware payload", "value": "03736ec98bda591eb69bebe798db1b1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869043, "uuid": "fda06e02-d81c-479c-b6d7-76170d59665f", "comment": "Malware payload", "value": "e45ccf8161e9bd6a3cd50caefa1c86a4edeb772264d1977c26d828edba2df022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869043, "uuid": "640bce85-7491-4375-8356-329a26e766f3", "comment": "Malware payload", "value": "d12bd731398615831308e78d3a155c8b520b2179", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765869043, "uuid": "bcbf77bc-51ab-4973-b27f-9875c5d727b6", "comment": "Malware payload", "value": "fe474db4de1db57697de9a0af0c5550159cdbe924971d6fc754e81742a8d21e081567f080cb82dbb8de37df900d31f7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869043, "uuid": "5fb38193-fcfc-40fd-9d0c-abde9270b34d", "value": "T114B3D81E2A619BFDF15D823487B3CB7556D4229127E4C389E29CDA082E343CD6C4F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869043, "uuid": "c3b6a54c-62d6-4cd2-a36e-dcb43b691d44", "value": "1536:1mkqotbjB6rhvaJXM8EOv7E//x7xA+dkYgboo5jr+6KZ9GsPgAUA1q:1UotnB6daJcqO/XdHuoo9Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765869043, "uuid": "a5e3c988-083f-4fa9-9957-0ef6d22d0e32", "value": 111851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765869043, "uuid": "5dd3b0ce-c043-4aec-aef5-98db3a271090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765869043, "uuid": "e84cd625-c0ab-457b-b04f-c855d97356b4", "value": "n2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae984df-daa4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765906095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906095, "uuid": "bfb0603d-c0df-4109-8ec8-9ff833a10651", "comment": "Malware payload (Mirai)", "value": "0f7c303d7b97736d14e20147019379f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906095, "uuid": "2afcdccf-d036-473a-8740-f30275c1319c", "comment": "Malware payload (Mirai)", "value": "e464a2ef70088b5d513d62555153981540e568e5fc720b852a237cb2df3ff465", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906095, "uuid": "b2228223-9cb5-4238-96c9-d2b14ef5f56e", "comment": "Malware payload (Mirai)", "value": "58a657a9199634c01100b776853678017b2ab6b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765906095, "uuid": "43cbfe7d-1693-4c29-b198-d423a079b76b", "comment": "Malware payload (Mirai)", "value": "32c598844011a3c64b863a5ab29fa5e330f69c4eb22f2e88a5d324a83d69e027c3246ac5eb9f229103d2a6771e6aae7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906095, "uuid": "52794fcb-2af7-4ac3-8572-74089e5134d7", "value": "T1B3D3C78EAE215F6EF5AC53B457B74F20DD56229267F1C481E6ACE8108D70388A43FF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906095, "uuid": "8a194ade-29b7-4aca-a242-edb0adf5ebe5", "value": "3072:rkiKtIwDKAawdILBlAKHSbwZ7qujWMA7HltI3MlYuDfvY3xwyWEwbG8N/GTPF4g1:ABtIwQch8LF/CrdTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765906095, "uuid": "0881cdb0-4bad-4d3e-96ac-11faf1f9174e", "value": 130908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765906095, "uuid": "2da29221-d772-44d8-b021-d4e94e882ef3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765906095, "uuid": "a76a3324-390d-4a46-86cb-c04ae3724201", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467fbdcd-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879754, "uuid": "f0daffad-edde-47f2-8f57-bcae1d93b6c5", "comment": "Malware payload (Rhadamanthys)", "value": "e85e1261c4861cc0bb64e275e078cc51", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879754, "uuid": "adac6dea-db18-4632-860e-bc8dd8d217e9", "comment": "Malware payload (Rhadamanthys)", "value": "e50fe3c9f1d7d5dd588d5c62b997dbfed499af87d1b54c6e74843ea51fb7a0ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879754, "uuid": "53ff01ad-e538-4db5-a3f2-1fdd5bad73b5", "comment": "Malware payload (Rhadamanthys)", "value": "92c07aa7953e3fdbf29138be24d809de633a73f4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879754, "uuid": "f55bead8-0a2c-4a30-967a-78f73ed6d389", "comment": "Malware payload (Rhadamanthys)", "value": "a412b0e32a0bfe454337ec2a11c5a53da63aba709cf81a6f0808ebb661aaf80beb7ed47369c43c9355971ea848363890", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879754, "uuid": "6fa35092-4248-4300-9f18-6feb287e13bb", "value": "T177A33B1CFE86DFF58BD7A6A47FE049FDD875080402810960A95BFF35109934B3E9A9E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879754, "uuid": "853c6837-17b8-4ca8-96c7-fc6270135353", "value": "1536:GDB7eKg20MtzkLsQhn1qpZ7RLjAHtH7aW+6/RpUf6KZbKeLpDIjjm3riWaner1t5:GDB7b00RnlizQC3NbgOB07W6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879754, "uuid": "75c1354b-8d5a-46cc-b3c0-101df729c3b8", "value": 99355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879754, "uuid": "4478f6aa-1522-4d95-955a-38b26a5a6c30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879754, "uuid": "90385877-1b2d-4f44-9752-35158245f09f", "value": "invoice-1637482117.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9401dd-daa1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765904840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904840, "uuid": "bfe0162e-3151-48a7-a2de-d8cf2c1389b4", "comment": "Malware payload", "value": "046d09a5bc5f2f7af8cddbb1b480cc5f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904840, "uuid": "65c3d433-6074-428a-ac3e-f04de1a765df", "comment": "Malware payload", "value": "e5a49062122c8c7a05187f50a4ccbf213f2f3b2e8df86806ce3acea7726bbb81", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904840, "uuid": "150d4738-bf85-4e16-8701-88507ffb9c81", "comment": "Malware payload", "value": "72c021aaacb6de1fff493227183069c59c20a427", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904840, "uuid": "7fbe88fe-c550-488a-8b7e-6c6adb16f15e", "comment": "Malware payload", "value": "7673d38ec6fc05b57a144ca5bcb99441b8eef886e7755d23ef684148c8953218396fb9b14132796cd6d582d1eef8a059", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904840, "uuid": "a7851f54-4c22-41f0-81a4-3abd039119e9", "value": "T135B633BF67BF4F9AE17EF8709662974C92558084E4C60DD36B08054305970FE36EA2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904840, "uuid": "1b0159e3-5b15-49fe-8471-d9ab3b116be9", "value": "196608:rCQ9OzO+2g6sZdoLX1A6+d85wACm2icxwYhu5R2gI89SW5AmcP1nWLI159+U5byS:rCQ4zOrQH8Bpkm1cxwYs5f9B6mcNnuIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765904840, "uuid": "7fbbd7aa-dfa3-4a87-9e00-ca4d0b5e5440", "value": 11243639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765904840, "uuid": "b7057f0e-31c0-4981-95a8-02f38f4e474e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904840, "uuid": "caa4bab0-7952-40fd-a0c1-e8b11d71f984", "value": "f3iifdmbe7mf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae3a791-da6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883359, "uuid": "e0be236a-a65f-417c-be44-1d7ab577bbc1", "comment": "Malware payload (Mirai)", "value": "f263d17fc83be328e0aa22ec5223fa14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883359, "uuid": "60a5479d-d050-42eb-a81a-d98e1419a1f9", "comment": "Malware payload (Mirai)", "value": "e6625e394b63fa1c329bf88b739a27fa16cbb53c9a2a9863b43f8260c80768e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883359, "uuid": "fe54bf7c-d24c-4d2d-8d3c-ba9db78e15e1", "comment": "Malware payload (Mirai)", "value": "2b245fd36669be594596de488711897af6dc047a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883359, "uuid": "d011e4ff-380a-42b8-9305-2cc6085774fe", "comment": "Malware payload (Mirai)", "value": "1a3b89c12ed944b583c11522c1c29f92453761f935ea7e61cc8f162ff32cca19716861ac08e1b857b7ec8eb5672572f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883359, "uuid": "a886fc8c-5a60-46d4-8205-48a13365ec29", "value": "T12DF3B70E9E219F7DF6AD537983B34B20CA59279227F1C5B1D1BCE9009DB0358A81FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883359, "uuid": "105b2830-8026-4cef-a6d4-ba9d19b5c064", "value": "3072:gqzibnRF+g6cJEPlaCDGHgNThmzO003n/pU3bSKb3j4XoQaWUYzjR1/nbLpwQHSU:gWibnRgEoaafPlZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883359, "uuid": "e04784b8-2a7a-4bdf-9326-a357bcfff9a2", "value": 159720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883359, "uuid": "e66f6e2f-91da-480e-8ab3-91843e961e7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883359, "uuid": "f8c8f7b1-e7a7-4ed7-a8c1-f11a2c21dffa", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888eb026-da99-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765901340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765901340, "uuid": "286b1eba-60aa-42fe-8826-cea874bd4861", "comment": "Malware payload", "value": "16168b2dc871e3c0f69b837c0d925f76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765901340, "uuid": "56e1b92e-c2e1-453d-9256-6c41ec1e5fac", "comment": "Malware payload", "value": "e6ad90bcbdeb7ef46f0bdd2d9a0a94be8a0c15bcb20022dd7433617ea78d785f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765901340, "uuid": "82639319-295b-4bd5-acea-2a4fc152f227", "comment": "Malware payload", "value": "9c8d28a143d87508c194c1670606ddf3d1e1d0bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765901340, "uuid": "f3ed2ae0-f1b3-410e-9301-0cb38cfaf42e", "comment": "Malware payload", "value": "58584faeb5936d3a98a82d864387e0ea8d051d0ae170b8d569b5af57d094e9136246c830540e3085d6c38fec5979fa8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765901340, "uuid": "20550183-998d-4f73-a0c6-529fc82958a0", "value": "T1A0F5D6E620C6A6DDC416C5BB8713FD7F888F7936862AD8F3A064F2225D25CC43675E09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765901340, "uuid": "5689fb51-8fbd-4681-8098-059dcd4c710b", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765901340, "uuid": "2f90f058-6d8a-4465-951f-2f91fc4a21b6", "value": "49152:PfzUi9Dt9HyaUp0VimykkoZPwdP/PaERrFsp:PfT7oYEoWdCER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765901340, "uuid": "a8a194b5-223e-42f6-a2c1-dbd985700863", "value": 3606017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765901340, "uuid": "dfee0de6-5457-4ca2-b659-eda59aa4e4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765901340, "uuid": "981ed58d-a622-46ac-b060-433fdaf13f8f", "value": "asdasdad.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4114a2-da7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765889272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889272, "uuid": "20f6290a-193d-4f15-8d29-94e3e7f5a4d5", "comment": "Malware payload (Mirai)", "value": "60aaab335a2113769845dc1b7e863708", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889272, "uuid": "d07896f5-1f44-4e6f-abf7-b4f9a5654251", "comment": "Malware payload (Mirai)", "value": "e73064d5f680ab5b03e152eaba50a2de9de2c068af093120432d479b6060d3b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889272, "uuid": "9abecb7b-0d3a-447a-aad2-8fd10ec2af48", "comment": "Malware payload (Mirai)", "value": "f53b5ca940be737080115ec4c8955f9ce1a84899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889272, "uuid": "917c8241-c25c-4d2d-88ac-7e9f047802ef", "comment": "Malware payload (Mirai)", "value": "f3f129a3ef802e17fe6c6bc0efcb325e0054ff9f46e3a00a37628a3e3b4dd10a105a68edde52d9805d45243d727dae1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889272, "uuid": "4744b9fd-ddd4-4bbe-ba40-40d0f9e8878c", "value": "T133934926BCB43F27D0D1ACBA52E38635F6754B4D12B5C719FDA10EDCDD360202A6A1B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889272, "uuid": "b49173e6-9e1d-4040-99a7-d5a52b9a19c4", "value": "1536:ZYJSU7At5lW6j64mWsVWyfY8tByoFP8gUrRY9IOXHyrL7YjyBdi:mw1XWZOgcY9G3sjyBdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889272, "uuid": "918ccc7d-8e4f-462a-a018-0795509545a0", "value": 93576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889272, "uuid": "e588c632-981e-4660-a98b-edbfc571150a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889272, "uuid": "3546e726-840f-4873-94e0-4945b0505ab5", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb59446-da86-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765893109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893109, "uuid": "052b2f2a-3aa2-446b-b075-a558313ba19d", "comment": "Malware payload (Mirai)", "value": "865694d0f9191365498702209f217675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893109, "uuid": "46a9fdda-234c-47b1-8fd6-7c8f531ee1d1", "comment": "Malware payload (Mirai)", "value": "e7c853d74e6ef667f97ee878c5046094068a283f3b024837abaa6501db4c2423", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893109, "uuid": "8ab190ef-a50d-4872-85f4-1a50d07574fe", "comment": "Malware payload (Mirai)", "value": "ccb656efdf30a1c21d75d8cfac1888c80362c644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893109, "uuid": "1830c3c2-444b-4556-863d-e67b7a059fc1", "comment": "Malware payload (Mirai)", "value": "dec70dc69476d222637c8a44040d911580a3d4f23025491254924f5bc4c04d4875381e876042798554e4651c90424512", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893109, "uuid": "8ead8abf-a125-4b62-9e76-83364ce1a02e", "value": "T119B36CD17108CD7DF88B93BB89770A16A954EA545F430F37A5A7FCA3A9230943D2ACC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893109, "uuid": "2da955ac-347f-4d37-bbaa-e940a06458a5", "value": "1536:wzYdF+bHMEsxWbbE+5Bl+Qu2pKEpic8uqbIChxyeFNbxHNvTqPMLg:wzYdFTE0+TopEEVPyyNbxHNbqPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765893109, "uuid": "ad6a4ffa-88da-468d-869c-c33357fb6363", "value": 114300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765893109, "uuid": "8c1d5e0a-effd-4c69-a2ba-b7b50d8007d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893109, "uuid": "a588c3f0-1452-422b-adc6-11c587af6fda", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2715008-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765905356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905356, "uuid": "49179933-e14a-4244-8cfc-d40366bf96ca", "comment": "Malware payload", "value": "3794c264f134f16527e0fe65643a7081", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905356, "uuid": "3dc2fa99-7385-4c78-a8dd-4c331e21d2cb", "comment": "Malware payload", "value": "e7cab8b8c7391ab878e27051b5a09e155fe618e4f74b4ba626497cc887707520", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905356, "uuid": "fd9ae6f1-a622-4919-9db5-2dcdfa0d4677", "comment": "Malware payload", "value": "5b1dc63a0afc252d4430fc0e01962cf6a4e8860e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905356, "uuid": "e6f780a6-a8ad-4b22-a32d-4913523e8aa5", "comment": "Malware payload", "value": "bfd874c5ff69f124bfeed5e0864f239a9b45f4add88977b71f1a04922880094c5765a15e6b08cb7b9dad2322990e777b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905356, "uuid": "ad0b250f-ffdc-487f-9870-8620fdb0c9a9", "value": "T11FA6333EEBFF4E8AD59BF47095A3D71CA252C05CD9C059630B0C4BD298932EA63705AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905356, "uuid": "e9bf61f1-d747-49d5-9fea-3328e6ee7099", "value": "196608:1j7V7cTeDQUbbE3MSM7AWDlcZHemdoPR2gI89SW5ARcP1nWLI159+U5byn:1j7eSDwcS8cZn6Pf9B6RcNnuI159+UU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905356, "uuid": "d63f3764-f84c-4d61-aa86-c38ad1c4720d", "value": 10059603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905356, "uuid": "29c643ed-6639-4590-bd42-da6056cce3fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905356, "uuid": "1d9a2f6c-4805-40bc-ac0a-75ed07305411", "value": "por2nbixw7wm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cf63b0-da84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765892151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892151, "uuid": "01252b5d-f9ab-45d7-99e5-27ca1e17b2d5", "comment": "Malware payload (Mirai)", "value": "909947c4fe43a836f81f19e7f95f62b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892151, "uuid": "9fe28dc0-628b-4927-94bb-a14176a34d9a", "comment": "Malware payload (Mirai)", "value": "e7fd5afce6f3aa61605eff816dcdd16f7fa5e36be845a6013da813bee4d4cdd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892151, "uuid": "7f55d929-88cd-4d29-bc8f-6e441f3b481a", "comment": "Malware payload (Mirai)", "value": "003659339d2d5c76dc16167ba682b736b1820eec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892151, "uuid": "9dc4f0ec-99dd-43b4-841f-dc0656433ae8", "comment": "Malware payload (Mirai)", "value": "64bfdccabd514900da93e27a85e02cf81f139ba6e9b4416f574602317daafd1d1e2f99a5a3354cccb95364d303875329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892151, "uuid": "54776086-bd36-415b-979d-aa93dcd7d26c", "value": "T1E6B34B22FCB53E3BE0E064BA11C38537F5B54B1914A8CE29BD610DDC9F395A02766A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892151, "uuid": "1bd8750e-73a9-4803-aa16-59c71af6d7ef", "value": "1536:4ZZetjfVWWXei7mIXPjdSy72zIBt13DSrYkNGS/xWyjdS0uPOljb2BLHpV:04xjQy7OjxWyjgQjyBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892151, "uuid": "c264fca3-2708-4360-88f5-2cb3df415abd", "value": 107708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892151, "uuid": "27798bce-7412-4f85-8244-baa6c0b94d08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892151, "uuid": "fb5e756a-468a-4172-bd6e-220ec56ce697", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f305513c-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765896365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896365, "uuid": "0d8e107c-b26a-4a42-b0f1-323e503bddc2", "comment": "Malware payload", "value": "e400929d2b3d4d1f3b5d7db34817d540", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896365, "uuid": "1139ee9f-a1cc-4e8d-a4f3-0b26d633ec40", "comment": "Malware payload", "value": "e8297faaac671bf36c84493f3406f3ef5b74ef3691b7d660bb08e2eb3000d498", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896365, "uuid": "5fa9cdbe-6597-4488-87d3-cf9b6f8d3b56", "comment": "Malware payload", "value": "5c945846c3b66344a1e28036dafacbbad24168ff", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896365, "uuid": "df5cfe4f-ecf3-4186-a184-f11a2b858ddd", "comment": "Malware payload", "value": "4edb644a6aab355597dccb9b6dd735ac8dd1e72c6c8afabcbdc0a78b6027ea6531071e8c71e1128cc5acadbc07afccbd", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896365, "uuid": "3a5467d9-1cac-4d40-aa1d-1e2e57be3ecc", "value": "T160E4E7EA7385EC369A4E085AE1F3BB8C5FB45FD10F641B3BA06C6DC1458C487B6A01B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896365, "uuid": "734399c7-1863-42d1-a399-834a6411a4f5", "value": "1536:JOYMjx6sGcmtUe9C2P358o6JdXwpxDtmTnhT3U4Eh6TIiOOlg4weiVhWgD5:JO9Gf9LSApNwT9UVOlh/Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896365, "uuid": "26de457c-3a7d-45eb-821d-f0f081096b5a", "value": 658368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896365, "uuid": "3ae042d0-6143-4637-9040-e28bf04c830f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896365, "uuid": "53a8e05b-58b3-46e9-93d7-5d19d1868ec6", "value": "Procurement.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3305485-dab5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765913545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913545, "uuid": "31006d39-9947-46c4-9eac-6bcc870ce32e", "comment": "Malware payload (Mirai)", "value": "597c4b48c19e3437acb8334863754187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913545, "uuid": "203f4c9b-ecae-476b-8b3c-398bb6fbdb7a", "comment": "Malware payload (Mirai)", "value": "e82a8392bfe4820bcfbebffdb1e1e0039506a24b22795f21fd21c55202dade46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913545, "uuid": "a0101c52-a5dd-47d3-a31e-7ee124cbdea5", "comment": "Malware payload (Mirai)", "value": "0a7df94880af5e5493787ca968ae767323f99d2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913545, "uuid": "91254a43-ad56-4ba6-981c-77dd62188b16", "comment": "Malware payload (Mirai)", "value": "71af67a52c85466d5de2d0b3e99e28a80e0c969d144adc1811b95018723549561b293a153ea8e44b1e83e45406f4d25a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913545, "uuid": "cd998155-b0f3-4552-a512-51561a282da4", "value": "T10EB33B85DEC3C0BAE858413E2173173ACA35F93A401BDB8BDB65AC34BC9161A85597FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913545, "uuid": "03e580b1-be95-47b8-a143-a3339e371f5b", "value": "3072:LKiR85nD+l6jQCgbcy8NLFCTRnhpBWnICvdAToDD:LHRAqYQRbcy8NLwhpgItTov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765913545, "uuid": "5c766d49-3d17-467c-af12-47db46ebcba3", "value": 112784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765913545, "uuid": "1518d58f-4eb2-4494-8348-7fad2be3e551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913545, "uuid": "18031a19-7689-42f5-a89c-d67632788278", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ae9870-da76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886299, "uuid": "e4b4c14c-b7c3-4af0-ac7d-aba76bacd885", "comment": "Malware payload (Mirai)", "value": "0e94976d7715b3bd2edff75bcf46e91f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886299, "uuid": "01f10377-4cc7-42de-88d7-7181c64e4562", "comment": "Malware payload (Mirai)", "value": "e858a758ade70d2d9e59c96268123b4833ec617ef51bb28a63e7b807125a928e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886299, "uuid": "9d648b4b-996a-4f7a-8bb2-0d833c2249ca", "comment": "Malware payload (Mirai)", "value": "571120bf6d45dfb4a5dc9274f42a5988a93b8cb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886299, "uuid": "7dda0c48-3269-4585-b66c-52b5c4b74a1c", "comment": "Malware payload (Mirai)", "value": "8944aa8fccd92afa993049cd62c333d375280c52c55036967a9adb05ddbd63a20a7f35f2bcc4f87a6927851d01925853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886299, "uuid": "e37c5b64-28b4-471d-94b1-0e349acd27bd", "value": "T187C34A31EC743E27D0E074BA51D38335F9A95B0910F88A1DFD620D9DDE3A0A4267B2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886299, "uuid": "769c61c5-9baa-4ae7-a140-22564f42c606", "value": "1536:ko0eSXKAsOunWa4OkYLLZeQKVW8mDRN80Bsim0fQH6bEy3btt23WAHxu41M9JMq3:kl/AJWnG64Xr60oHUPSxNAJMIsNfjyBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886299, "uuid": "19049b6c-d1f4-42ac-a87e-59323961b122", "value": 125660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886299, "uuid": "0737f50a-19f6-47fb-bf38-1e037d5d349e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886299, "uuid": "11e107c4-aa5a-45e8-ac05-a4948761885e", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0d8c6d-da75-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765886047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886047, "uuid": "99bc2daf-dc11-4097-b17c-ae323b2b38a4", "comment": "Malware payload", "value": "a4707aa6a97826a5d8d6df0a88ee77ec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886047, "uuid": "c439dc15-aa81-4c14-97c8-2c9215764fc4", "comment": "Malware payload", "value": "e86cd37c9cc9313aeb0fc956c4ca5e2990f2200032401d27a5036daffdd30bd6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886047, "uuid": "16a6d96c-2daf-4aa0-817c-94928a05e6a9", "comment": "Malware payload", "value": "668b1703ec878384f4fd5dfaf02d6e4396f4069c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886047, "uuid": "281a0010-2fce-4c6b-89c0-262adedaa93f", "comment": "Malware payload", "value": "de0e666a94c3cf306aa00bc6481aab09ab8ebbacea759c1c4bddc3ca88600d5ef48847a190aa1245143271d3d83de271", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886047, "uuid": "dae44739-ba98-485a-8be5-cd670c97c2eb", "value": "T1B78312D39A9971E1E8B73B39FD22B50CF4179823E3A10197D74F496B3056B04B7AA0D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886047, "uuid": "1edb4762-a5db-4a15-be15-ea7e058f2188", "value": "19e986afa8d67a4781680e16b5b45947", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886047, "uuid": "7ffc3343-0699-43a4-89f6-b5e64ef63636", "value": "1536:oXOjADXDzNkt6OBN0Mir6wbGMONwBv9EKFQ/3lVn1nCuIsn:/+zOkhbGfwBvTQvlrCuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886047, "uuid": "7b49951c-eb3d-40c8-a1d4-7df56ee39438", "value": 81576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886047, "uuid": "0ae426dd-21cc-4bec-8c3e-43be752e32c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886047, "uuid": "aa0ff4eb-8ffb-4054-903c-2d6197eb6a28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45a714e-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765880019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880019, "uuid": "50bf6ac3-6e9a-40f0-9504-da1b6c92c676", "comment": "Malware payload (Rhadamanthys)", "value": "6fbc6a3fb0c11a29543334c61f7be3cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880019, "uuid": "21a43746-5ac2-4ef3-a72a-7647376036a0", "comment": "Malware payload (Rhadamanthys)", "value": "e8e843895a41ee7f07980a24fa7a77f0a7c8b61ef2097153ca504907f1cc7315", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880019, "uuid": "5d6847c3-21c3-4920-a057-e3fc51ce4b8b", "comment": "Malware payload (Rhadamanthys)", "value": "54fafe799091d0273a7d119fe7226b8e64b15e5a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880019, "uuid": "517f8120-2fc9-4472-8df8-51217f095d94", "comment": "Malware payload (Rhadamanthys)", "value": "8651b0e1ea3c88c9e2ce176c7a0512cc3dd13a7509f32f9c6135f8af13c2b03b1d075186a288c953d4231db2f096d847", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880019, "uuid": "92483bdf-0f7d-4efd-870d-2b5e08a20792", "value": "T18AA33AB4AD53B5EA107596D84E603EF50E1E3F8855E7B1C9560A7BA1041CBC8F8EECC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880019, "uuid": "ee983b3e-93e1-491c-8461-c14b62d26988", "value": "1536:GDB7eKg20hw+hF3fLrVtRg8r85npqh/23luTTYoMTv6fAn7HNlhQDqeunRaFnuLQ:GDB7b0e+/Lj67U26BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880019, "uuid": "8d2ea5a3-f119-436a-8997-4db5ff92639e", "value": 101425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880019, "uuid": "cad4fef5-f4c9-4313-8c2a-80f30b8edd19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880019, "uuid": "6d6cbf1e-2785-403c-8941-94fb94b27496", "value": "invoice-1637482117.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91415b33-dab4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765912951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912951, "uuid": "a99adc49-6d10-4501-823c-8a006d0e5f11", "comment": "Malware payload", "value": "87abf8d85dfd031528e287b050d8ba0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912951, "uuid": "de5007fd-ede8-4251-a1ec-3d5e35ae26aa", "comment": "Malware payload", "value": "e8ec9c53384a715768ade01a1538e90c1497eaf38d7252aa866f5fb4ca53d56b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912951, "uuid": "e28b41c8-5a75-443d-bbd4-6404925133cb", "comment": "Malware payload", "value": "43f15bbf75aefec10433ac67a64d0239ea8dd813", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765912951, "uuid": "e393a964-d96b-46ee-8003-b804330dda8a", "comment": "Malware payload", "value": "a5ecd3e62739775768f1108598121c5c147b1b819fbc25932162deae34b69aa36b9fbeae90cfa5cfdf25a2a174aa30b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912951, "uuid": "6d5cd1ad-8591-42a3-8901-ac70f2696664", "value": "T11CA307157C40DA92C6C076B7FF8F63AC731663C9D1DE7507A8146BA4778B0620E3E8A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912951, "uuid": "1cf4b978-f4cb-4133-8e89-b73514660bfa", "value": "1536:tyhD5LVBtzzUJVLkO8MVmt+0LiBhquWyApsvz8nXhVR15:tyN5L3lI45ImtdLQh+D6z8nXz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765912951, "uuid": "d9e6c6f6-9f4b-4498-ac9b-2dbaa45f1dd2", "value": 101316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765912951, "uuid": "198f4ab5-2690-459e-adf9-a3d60ff1eabf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765912951, "uuid": "8bd7cbde-5103-449f-9c71-9db52ef7da6d", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a84189-da73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765884804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884804, "uuid": "096c0358-66f5-4418-86d8-6c2768f88a3d", "comment": "Malware payload (Mirai)", "value": "7e62ca3f8f6a93b6fbdb13a7a87e9ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884804, "uuid": "e63c0849-a186-4e78-a50c-e2c28f76d6c6", "comment": "Malware payload (Mirai)", "value": "e9969a892d166743f30008622626f01013ef6b39b590b928b0048d18ded4c8e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884804, "uuid": "938949fa-55c7-4336-a3ac-fecd2074e9ac", "comment": "Malware payload (Mirai)", "value": "c7472cd7a9ec4714aec26de1dbe4c966b1da9a7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765884804, "uuid": "e8138264-22a2-47c1-aca5-f4e1165d358b", "comment": "Malware payload (Mirai)", "value": "2197c9f5646e0bdffde9cf2041cf6867e04e95ebda30c179bd9eb9dc5682b7dd9b5490ba4748f4fe9701a7e5780d5740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884804, "uuid": "fe16fc68-ab0b-4232-979e-63756afdcabb", "value": "T191D3F669AC418F51C9E723BFFE4F529C331253A8E3EA7027DC142B55778A41B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884804, "uuid": "3273a21c-98af-4127-beb6-7a5e9c402c41", "value": "3072:38MMK+nAlEX8idcr7f5sG3MF43OTZvKzfpRL4oVnr5V:38Mj+ncEX8B7f2iMF43OTtKzfzL55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765884804, "uuid": "85a230ed-27da-441b-84d7-e884b527c5ac", "value": 142340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765884804, "uuid": "d6c5ea35-5678-4066-8f66-c4cb1e1c23fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765884804, "uuid": "c379b7fb-cfc2-4387-b8c0-6910973caf60", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852c9ee7-da76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886302, "uuid": "e4c455fc-44c3-4e14-8e84-fd0931bf4822", "comment": "Malware payload (Mirai)", "value": "bffe6b1eec13362e1693806f52d83ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886302, "uuid": "d0c62c0e-d727-4e86-8845-a80e32eab7ee", "comment": "Malware payload (Mirai)", "value": "e99ca7bfa772e0ebd634e49ef13d98459b2d9b10add9389d7d94f7fb9621923a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886302, "uuid": "cc174f33-1dd0-4b67-89cf-b5bacaff770d", "comment": "Malware payload (Mirai)", "value": "536a1c85968fdfd4d44929f8a017d2fc6c84f85d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886302, "uuid": "da10a739-9240-4ac5-a760-4eafcb289552", "comment": "Malware payload (Mirai)", "value": "709036e95b9c12536d77c77fb422db85b0aca3fe43804f43dda0d391f6b48c4f961cf43e008998e8eca561d91498bfd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886302, "uuid": "fe36b87f-56d7-4e9b-8e04-5a67d6c9eb7d", "value": "T1C3B35CC16001CF3DF91B963A897B4B19ED24F6514F920F27A993FC93A9221A43D2BDC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886302, "uuid": "f585683d-4c19-408b-b12e-fcd47f00c88c", "value": "3072:ZHMu6nkEP8sqmA0k4gjdqUZDtl6jmMryyyHZc:/6x0Xmk4gjV7kjmyyyyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886302, "uuid": "75ca9ec5-3c57-4b8e-8223-d808c61f6342", "value": 115304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886302, "uuid": "96e30b73-6a10-40a1-9047-988c0673c7bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886302, "uuid": "079e0cd2-7c87-40b7-b641-ec4394d7ffe7", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b9237f-da78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765887023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887023, "uuid": "897beae2-db0d-4291-8c5e-00071bc1767b", "comment": "Malware payload (Mirai)", "value": "828d2c250d1063047dd401643e85dc10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887023, "uuid": "c1a69306-2878-4f4a-91ce-a3842e235876", "comment": "Malware payload (Mirai)", "value": "ea1860d1d9069d55438c539cba94918a3184da67f103fe8f4072e83120f9bf54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887023, "uuid": "5c0da065-832c-4cc1-9820-2b60c41311cb", "comment": "Malware payload (Mirai)", "value": "17c7aa1f689a38bfc318b0c5d1a0c389b7ea714f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765887023, "uuid": "de055438-e197-48a6-8f4d-ccdd35abd797", "comment": "Malware payload (Mirai)", "value": "2bf3d777bc326d7a61535631b031d6f28ff6dd611c01062a4470f59a846ec622239820436ffcf2ca44128329fd4b43ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887023, "uuid": "37c95083-a7f8-4d7b-92b6-bb24f6934f60", "value": "T17FD3F669AC418F51C9E723BFFE4F529C331253A8E3EA7027DC142B55778A41B0E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887023, "uuid": "06c18434-cf87-4f62-a66d-5a02072a59c4", "value": "3072:38MMK+nAlEX8idQrLf54G3MF43OTZvKzfpRL4oVnr5V:38Mj+ncEX8BLfmiMF43OTtKzfzL55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765887023, "uuid": "25eb531b-6712-4eaf-bb1a-b734ad9bc60a", "value": 142340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765887023, "uuid": "68baf050-a096-4004-9191-d99a7fb85a75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765887023, "uuid": "234b2150-bb01-4a29-83f3-78b036e93ed9", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca721523-da7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765888995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888995, "uuid": "b6a4614e-6d15-4426-aba1-fd5231f1a927", "comment": "Malware payload (Formbook)", "value": "1f03e1c9bd87ecfe3806f6c82740737b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888995, "uuid": "2680b575-95cc-4b76-94c0-6c7205c284de", "comment": "Malware payload (Formbook)", "value": "ea1a5491338fdb51e0561e73259c79751c87844f0f4473129e2a5d192a93256d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888995, "uuid": "f2b8036f-6a6e-4bfb-9e98-b25b8a765497", "comment": "Malware payload (Formbook)", "value": "6d5104968e86e3be3bed66ac76e6e71fa0407c8f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765888995, "uuid": "2f610b4a-854e-42f6-8588-22396e7aaef0", "comment": "Malware payload (Formbook)", "value": "6edaf1dbb9c87c24f4bfef48c4cd6fa18e0d43e20995e82e9bad8c445eb9fe6ea68e229b3a7d869598b36c6c683cec08", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888995, "uuid": "bf370388-00fd-46db-a9f2-574de1f10b6d", "value": "T1EFE412376EEA3C7DC11C98FB10A3B233706A9D5484B936458E4B23CD2D6166E25454FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888995, "uuid": "860df886-08ac-4e38-b4d8-ec6132e5af54", "value": "12288:cSuHgnDhA4F9WKLo49T0J1JkjDXb/QSzO2cysDnv6n46thkYJHf1IuWSVqWKgdK:p2gdrFt19gJ1JwLz8Hnyn46LjJ/CuW8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765888995, "uuid": "7851f45b-ccb7-4638-a67c-2fcf4ae3768a", "value": 672813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765888995, "uuid": "55e90ebf-7e97-4b57-af35-db6d27432465", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765888995, "uuid": "6f9d674e-a4c3-4877-b172-3ddff718502e", "value": "STATEMENT OF ACCOUNT.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e282d4f-da18-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765845783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845783, "uuid": "c6721b64-94c4-477f-9a4e-015ba4c22e47", "comment": "Malware payload (Mirai)", "value": "87cad5db5ef5241341e1c81a57bccce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845783, "uuid": "357896f4-4438-4c8e-9c71-e4a44db798bf", "comment": "Malware payload (Mirai)", "value": "ea2fa274329ba473e40ad116b7f4a7959a76cbcd3a44637b7efc94072d227923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845783, "uuid": "f19f5326-7cc2-4bcd-bc5a-76b30a9ca06a", "comment": "Malware payload (Mirai)", "value": "5f589ac450e333722141de203c9beb6433f23b94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765845783, "uuid": "0d7173c9-feb9-4e90-b233-51b8fe27f4b9", "comment": "Malware payload (Mirai)", "value": "fc942e414edcb811fdd545091a6d356fb6bcd1f0652079550645a5497c259c23b2bef29089516d63e37d42d972cb6f33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845783, "uuid": "800f644a-5f38-4ccd-adb6-b91c99a83fd3", "value": "T1B162C689BC92DD1AC4D153BBEA5F461F3B10E3DCE3CB3B07C9591FA0B60A6584E52A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845783, "uuid": "a1dd59d7-b4bd-4401-8e52-4073c3ba5b9e", "value": "384:sEHCOStpXsyaj0YDXTYbFWPigIc3HuvI4606yVR9:BHpSrcya7DXMbFWPig6vI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765845783, "uuid": "471a40a7-3f6a-4175-aca5-53b5b5250a78", "value": 15856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765845783, "uuid": "79aebac9-f0bb-40b0-985b-2037b0c5add5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765845783, "uuid": "0693fcf2-3b97-4ce1-8a56-47f72d2005a7", "value": "nuklear.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f72a37-dac5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1765920178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920178, "uuid": "048675ce-001e-417e-8a24-7936d64d5a4d", "comment": "Malware payload (Gh0stRAT)", "value": "75d871c096432d22cb460928a79e8e6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "Wacatac.C", "colour": "#0CB4A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920178, "uuid": "2436a619-b7f2-49f6-9075-29d89d60c9f4", "comment": "Malware payload (Gh0stRAT)", "value": "eb61dc56ebbf4e7b8b17a33699cc48229fcec9a500341dfca9331e9fb8e091e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "Wacatac.C", "colour": "#0CB4A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920178, "uuid": "f55c7e6b-53bd-48bc-9b42-5cf528bd397e", "comment": "Malware payload (Gh0stRAT)", "value": "671727027e00474f5abb36c275879eadf2bd2443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "Wacatac.C", "colour": "#0CB4A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765920178, "uuid": "2bd91915-6c84-4e2d-99bb-c19d67da330e", "comment": "Malware payload (Gh0stRAT)", "value": "6d5d08882ec325ead7d5e59d0cbba8c709fa9641f8ba7bf7c25c7d0e820eed640df0265081a82a2d2d2054d5f140dfec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "Wacatac.C", "colour": "#0CB4A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920178, "uuid": "d55ee6b3-afff-4b5b-a3e8-87066d431c14", "value": "T1B2072317E38E533FD4A685745962A918EC7FBA30D52B886381A45DDCCF2D2502E3EF42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920178, "uuid": "ba982c26-5482-4478-9b7c-6bd74b6f8eab", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920178, "uuid": "00fb9afe-db0e-4a80-a01f-e8d38a8d809f", "value": "393216:5DizFBEJzaIhM/zIA+AD6RJ0t0wGKaMrj3FWflRj0vQmexbxwWsoFQd:gzYJzaIhM/zIZARtT1eKQDdyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765920178, "uuid": "abed8ce6-1b35-40ae-bb14-ccaeb38b7ff8", "value": 18378889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765920178, "uuid": "f4670b78-fc8c-4948-8ad4-056dd4f89fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765920178, "uuid": "745b8403-3ea5-4a65-9a89-052802e4bd2c", "value": "\u9879\u76ee\u7b80\u4ecb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5f572f-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765852786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852786, "uuid": "e084e0ea-7434-4eae-92b0-f164057a11d6", "comment": "Malware payload (Mirai)", "value": "8ed1a0ed09f29243d724c87bf2cf8899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852786, "uuid": "82d75f32-5132-4234-8205-fe7ec4ba231d", "comment": "Malware payload (Mirai)", "value": "eba79f666193df5610fec839a569f5bf0b670a9e7899a3e0a4f0c9ca709e2251", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852786, "uuid": "28f98755-5999-4643-9986-117dae598798", "comment": "Malware payload (Mirai)", "value": "da649a6cea61dbb9ed06526092da402eb8877e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852786, "uuid": "2bdb6ecc-04c4-45ec-8746-935ce27f6230", "comment": "Malware payload (Mirai)", "value": "f280e9680c642b19be8266bf7d76255129955899dd018a1fd8f2d46e7b9d53861c883ab4338491299c1829eb902fd317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852786, "uuid": "e786e4e1-5b61-4a35-8a36-8112c70561c0", "value": "T101935B23E152C6BBC0C796B41BDB8A619823B4B91773724A33D87DB53F128D95E5CB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852786, "uuid": "c09c46fa-1984-4e57-9473-10b49ef84f35", "value": "1536:U7V4QXQy0EINE3/i7CZ3Qwmr38QUdGvbYgJWAQNIKmA+BWYXFUjaZ3tX:aDQPEINAFlQwK8zgUdLm/BWYXFYaZ3tX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852786, "uuid": "1e70c325-c799-4b67-ab60-bb775fde2e62", "value": 96413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852786, "uuid": "b815e6db-278a-48ed-8fbe-5baea868eb21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852786, "uuid": "fa2bdccc-e60e-48fd-8b9e-e446e0e233a7", "value": "Fantazy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8526f490-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879859, "uuid": "742baab4-9195-4656-99fb-2740f1708a13", "comment": "Malware payload (Rhadamanthys)", "value": "21e7eaa8857aa28faa8c92859c184b2f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879859, "uuid": "ab66050a-e367-43a0-94dd-222eca43a3f7", "comment": "Malware payload (Rhadamanthys)", "value": "ebab8c736c0943d2025006be39075baa29d61ac8ec77cb8eb3d799841bd4bcc6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879859, "uuid": "447e9f0b-651b-4f27-ae72-5954aeec7c0c", "comment": "Malware payload (Rhadamanthys)", "value": "3e8557a13700c591e09f0299c49aead68e0c8052", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879859, "uuid": "12ad0517-73f8-4473-807c-e5e8fc402d2b", "comment": "Malware payload (Rhadamanthys)", "value": "ed95ad53328ecff47bae87218b77fb15c351349e5056da7ae9ff0b308a3cb288d0254eed92d2cb08abc37262cff77e27", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879859, "uuid": "92987d35-8f71-4d0c-8237-4603dc9eb89c", "value": "T1FDA30A214413CDF4018E667B7D6864A8448E985CD4FCA138D3AFFA3027A9F9B9C9C6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879859, "uuid": "e6a645c2-7f91-48ab-83f7-4a66f57ee446", "value": "768:GDhd0i7J4sYKgY/CMNfWdLG0Qx9oBRrXgAr+yElEzHokVqPAcBstvUjSLAuAAroU:GDB7eKg200mr3r+yW3/Arcj6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879859, "uuid": "931e0844-4f05-44bd-9275-b401a0248a78", "value": 98179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879859, "uuid": "ef0c70d2-e03a-4adc-a230-f3f186aa7633", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879859, "uuid": "207378fa-9fa2-4fe1-8ae2-06ddcfaeda87", "value": "invoice-1637482117.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe252ed-da73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765885058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885058, "uuid": "6ee5a41b-6df7-41aa-b56c-e956a1b3f3c6", "comment": "Malware payload (Mirai)", "value": "69083ee40fe135b659733e37c2a1e784", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885058, "uuid": "e13331c3-0608-4077-a946-5aaa3da43256", "comment": "Malware payload (Mirai)", "value": "ecaa925caa5e49e06c721d6412db2429e74810fc9b79d00f145331d4982fd52c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885058, "uuid": "a19033e9-0430-4dae-890e-ff460ecf51df", "comment": "Malware payload (Mirai)", "value": "fda931490bef59b96270f3e5cd147247d1027d05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765885058, "uuid": "e2129977-dfd7-40af-b5c8-258e1a0e1173", "comment": "Malware payload (Mirai)", "value": "1c4877a2b47e1d7c4f60a17c5f86393e1a0c0a86ce8541f999fce338a44e0eb594dfcee72a715625565da1e665166aaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885058, "uuid": "a4e7f778-71ec-4e1a-93bc-2bed3f46c9a1", "value": "T14C9308247D818A16C7D4237BFE9F029C336A53F4D0DE741EEC202B56B39A0570D3A99A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885058, "uuid": "ddb96f03-d3b4-43c1-b086-731a68c2de96", "value": "1536:XnkGlJ+yjb6miPCATDQC7eFutzzQ+6WNL3r8nF5vwww:XnXPPjC7kulz6Ijr8nF5vwww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765885058, "uuid": "51cf5846-954d-4de2-9e66-79374823c142", "value": 89612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765885058, "uuid": "9d9c28fb-f0d0-46d0-be21-744dc369a269", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765885058, "uuid": "381d705b-8a99-41db-bcab-d9e11aa4a239", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d634e6-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916420, "uuid": "e8435fa0-41c8-4192-8f8a-dc552096547d", "comment": "Malware payload (Mirai)", "value": "0d4f854cbdaa7495c863028baf2a9223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916420, "uuid": "52744a14-7192-45f1-a066-fd43d1e58431", "comment": "Malware payload (Mirai)", "value": "ecc57dad5f28e2f8b0cb3182917d3e985894130c8ad4f640f28dad25a3dd8ccb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916420, "uuid": "1003465e-d7cb-4e8d-9ae2-ae7885e46d46", "comment": "Malware payload (Mirai)", "value": "fa546ae82523bff726693eebb51c6da72f5677fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916420, "uuid": "c4470ad7-de21-476f-ae1c-cb70eb899182", "comment": "Malware payload (Mirai)", "value": "796d83e559286f67ecb035905cf42282c0b5dd2a2cee2a517c7f0f2f80f924d16983acb676553d88b2bd058a3adb1110", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916420, "uuid": "02a3550f-7edc-45f0-87a1-e081ff827b38", "value": "T1AD631986BC80AB29D3C0177BEDAF109E3300B7D8D1DA3246DC145BA47B8ED6B0D56B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916420, "uuid": "80024201-6a6b-477c-bfbd-5926c3ff2a8e", "value": "1536:E1fXFPNLSYy+Hrw/+tAZX02aYXwDCXfU2/d45y:S/F1LSYyh/pgD6M2Vqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916420, "uuid": "dafd8850-4402-464f-8595-a9ff37fac8b2", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916420, "uuid": "7e181101-d917-484a-899b-5bed3be8d028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916420, "uuid": "20aa0105-4f82-42b4-9c59-5db15a0b67c7", "value": "Fantazy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622b9223-da6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765881519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881519, "uuid": "240fc6e7-7ba0-4621-a29e-9b9274448e9c", "comment": "Malware payload", "value": "2b68cbc49ab740df5046f1caf826f957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881519, "uuid": "510c5490-3bb3-450d-abbe-72915c9b8eb0", "comment": "Malware payload", "value": "ed2004b277635076a9c4a8bc9871abc4a2b3172df8aa0fcd7ff8688c6bd69633", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881519, "uuid": "b0938c08-16ec-4cbe-8a81-33789a5b323c", "comment": "Malware payload", "value": "19c96eb6c07a4a735c7432227b6844613fac9c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765881519, "uuid": "91765440-65bf-4c6a-a7f2-f3e2e2346e87", "comment": "Malware payload", "value": "0771cf9291d13fc83963511c9060e26a5dbe5220723c5af60cb8f42216738afbe0a6eb37fff6bd8c9d2c26e1528caac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881519, "uuid": "6503b87b-3566-43cb-afb5-0be68e356ecd", "value": "T167542A24339D552AC37F6778C4A60500D7B45A67E26AE74E7C1C70E84FB3320E6A36A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881519, "uuid": "585fe673-2b09-44e4-93cd-d5aabae4ec50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881519, "uuid": "5fb980d8-6954-4af3-8fb0-5a920e3dcccf", "value": "6144:BB5C1V8zF0Oly1R4oCrmh1aGgMsjF7Nzphrs03LeaEa:BB5GV8zF0oyDZ1VijF7jhrscEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765881519, "uuid": "5b832245-ed6d-443c-ae55-b5ca7e7c9f21", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765881519, "uuid": "bd4bdb5d-719b-4f33-b77b-2a1e596ecc27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765881519, "uuid": "0e07a095-052b-43c1-9aef-2741b50f1357", "value": "cdn-10049480.file.myqcloud.com.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcf4088-da82-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765891658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891658, "uuid": "4265d4c1-e2f1-4927-9e0d-7694ca14b27e", "comment": "Malware payload (Mirai)", "value": "7deb8170584ee4ae0aecc817d7017b36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891658, "uuid": "072ca3e9-406b-43ee-8c18-83b90374cfbd", "comment": "Malware payload (Mirai)", "value": "edb084c8d7d1b458981daaf8ec5be00e42ea9cf529be87308c5714fda405df47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891658, "uuid": "93ddcdce-9498-4ba4-aab1-425115e2f1ed", "comment": "Malware payload (Mirai)", "value": "5f51754dfd2060b06b3debdcf5cf450cf353a764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765891658, "uuid": "cbde6d58-0f69-4c77-b1ad-8dd74794bbac", "comment": "Malware payload (Mirai)", "value": "6140a3ad7d16bce65c74770af0e1749fcfebcac58cbdeb83f2f1f21d5d0a4e6f67c1b3b097550f231dd592ba4a444463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891658, "uuid": "b1aff89d-bec4-46c2-9e4a-849a06d30161", "value": "T1EAB31987B3194343E0524BF56E3E2BE8CFAC6D6852A8FB4C645B260D41B2C77C445EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891658, "uuid": "2c4d5f86-645c-43c5-9970-c8f74d2018c4", "value": "1536:3eNGoo6lUGqcTTrsB5Fgl8GQivsdu6u5/HBobc8nTo5/777DNNxxCZrO:ePrI5O8GTsdhuNj8n85d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765891658, "uuid": "68d7014c-67b4-4825-adff-e099340e0647", "value": 117484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765891658, "uuid": "abf08eb4-f443-424d-a59c-d7b3510008eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765891658, "uuid": "ba0c5862-a057-414f-b186-9cd877c9b728", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e44e247-da8a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765894853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894853, "uuid": "6a2794e7-c231-4959-893f-5f9f88c45f5a", "comment": "Malware payload (Mirai)", "value": "78df886caa5f9e72696bd88f8f40d25c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894853, "uuid": "a6c3ac02-9e30-41ae-a665-faaa49cee1b9", "comment": "Malware payload (Mirai)", "value": "ee22fc10bf4dcdedda78c3c7a5586531e01a63c6dccbc3e57ffa314c44143cc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894853, "uuid": "dbd0665c-7530-4b37-9f07-08dbc195a9f9", "comment": "Malware payload (Mirai)", "value": "3360bfce2f8bb79555b4c34c9b88e6c3bf928f56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894853, "uuid": "3661c8ac-cd1e-43c0-8c21-85f5913131c2", "comment": "Malware payload (Mirai)", "value": "3724ad6e2d44cc4e0042899a18f69d3bf185c3109dfac0f199a6b5eace09d45cff6d72404396a79bac945ce3e922f696", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894853, "uuid": "34c7b52a-25c8-4cc5-846b-455fb0d3c80b", "value": "T1CEC3F8456D418B12D5D323BBFE5F518C331613A8E3DEF91BDC202B6977AA0270E3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894853, "uuid": "f126ede4-6064-43a4-ab41-5a3407960391", "value": "3072:gpkNw1bwHlm8P5rQ2+ard4K4ykKhVnp5RrrrfG:gpr1bwBPRQtar6K/ZhHrrrfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765894853, "uuid": "c0e1c00c-2886-4202-a4b5-8264977677a4", "value": 124096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765894853, "uuid": "9c51d667-2405-4ca9-9464-04d302095887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894853, "uuid": "7edafe38-eccc-4c5a-8d05-8d4e9ea58a90", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee5d2c8-da81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765890935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890935, "uuid": "f9774c90-7089-4a34-a209-caf63b6d494e", "comment": "Malware payload (Mirai)", "value": "93d1d6f0041c0bab2570d68e5b2cc0de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890935, "uuid": "0129b115-15d2-446c-bda9-334d9c655f08", "comment": "Malware payload (Mirai)", "value": "ee8261928002d6ec2a60c67b3ed94338d820a75e1014272aec7434cef86b801f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890935, "uuid": "d12fb2cf-3cc6-4e8e-9bfa-a79a637f1df6", "comment": "Malware payload (Mirai)", "value": "2e5bae51c304408a14a5360c27e5fd4c76b81039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890935, "uuid": "a03ea5db-e019-4d92-ad8f-e6f787df5d14", "comment": "Malware payload (Mirai)", "value": "a7739695599cd56a9aeb8a8bf43673217427844d660d3c5eea88354b52e2dde31d04e6700a871aa6549c9a6079ec3a3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890935, "uuid": "ba54fbe3-e2c2-4431-86f7-51142c3ad6d4", "value": "T19EA3AE6344098EF4F1FC0B7DA4B46638C7176823294B3EBF69B980D44483D9AFA8E351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890935, "uuid": "44567b5f-3d89-4827-a8da-44751780f394", "value": "3072:iWoJ47xE8FJ83jxD7MCc3csJgL/ySqC9V7:iWHmp4ccS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890935, "uuid": "6356e916-b1ba-43df-8f71-896492662e5c", "value": 103740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890935, "uuid": "fbf99ddf-d8cb-4de6-8239-2c779fca88b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890935, "uuid": "c9c65aa7-7635-4b4b-b552-4d0f73c03f34", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6b8714-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879689, "uuid": "6e1130a0-1099-4c76-8f71-2264a6b4cb12", "comment": "Malware payload (Rhadamanthys)", "value": "50a271f3c46fd178a0f27b27e8fc430b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879689, "uuid": "e746f8bc-2442-4317-ae0e-793256e7745b", "comment": "Malware payload (Rhadamanthys)", "value": "eeae64d5c57ee0112076ce7308fc17e2b705d7930525fe69c0c33352fc076d7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879689, "uuid": "6e9ccc46-d9ee-4574-8f51-6be128ec6920", "comment": "Malware payload (Rhadamanthys)", "value": "d284edcdb3fbc30072fca80d45583a38187965aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879689, "uuid": "44ff8e88-d33e-4c55-a979-7c1976ba7cbc", "comment": "Malware payload (Rhadamanthys)", "value": "de3fcd9d168ce84ca157cb8f7cb679fced771128fd69d349e99889e68ae677014dbfcbb4346a1e7e3a1dfe9cd28d49eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879689, "uuid": "8d3f89d6-22ea-48d8-87b4-f5697e1ce731", "value": "T18AA3D9019F2EB8A8465333972CC359B35A42A7431426E06FD63F9763B0A0FE57AD25C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879689, "uuid": "3b39c22e-8088-4529-a9a0-01c6c914c295", "value": "3072:GDB7b0IygOXURwR3qXFrwGW2YjvW2WfTrvxpgtpP/r0iHsKH79l8euufYrCVIYbl:0MwlvOWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879689, "uuid": "75e612fa-b051-42ca-9b3d-78299807ff5d", "value": 101391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879689, "uuid": "da7279dd-d9ac-45fe-a083-991ed30ad963", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879689, "uuid": "74e00fb3-091f-493d-9349-d169c9c67119", "value": "invoice-1637482117.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2a292e-daad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765909778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909778, "uuid": "406457f9-5611-4de6-9454-032d1a64ff73", "comment": "Malware payload (Mirai)", "value": "30e16939c802ebdad9167e16ebcd9349", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909778, "uuid": "8414c192-2341-4ea5-9550-4eacbadb8bff", "comment": "Malware payload (Mirai)", "value": "eedf150a7cc043911c90bbc17ca28b6ee75974398c882bba2754b2d77e77d8cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909778, "uuid": "fb693f2e-6e98-4bd5-b366-d0f04dedaaef", "comment": "Malware payload (Mirai)", "value": "921b33062939aaf0c5cd38c44a6443acb81c12c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765909778, "uuid": "3b28cda3-e11d-495e-bc84-fe0927cc4a43", "comment": "Malware payload (Mirai)", "value": "1948708d50643d5d9d305e0e19fbc4bbbdaf7f9a8ece89dc5ecd9d571850242da82595bab842ad85ad7ddafad005f99e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909778, "uuid": "8b0ae318-5054-4063-9e0d-369a14aa8577", "value": "T167B318C26405CDFDF90BA67A85F70965B924EA105F530E37A592FDE3B9220A43D3ADC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909778, "uuid": "c421abd8-5e41-4670-87b4-82bfe715ef0e", "value": "3072:kREMqZEw1KMeOB7mJBHvTbdO1exU/P9yTTyrNCUBpBbbYzOHX0zNFy2IAmlmfQip:Kqm1coeC4wJo073l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765909778, "uuid": "352771cc-e2f1-44be-9c0d-fade72f62d47", "value": 114228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765909778, "uuid": "566087cf-e221-48f0-b84e-0447753d56d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765909778, "uuid": "f8405b3d-15eb-45ff-b26a-3c516c849389", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bd097c-da13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765843840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843840, "uuid": "e9fddd8f-006b-4970-8711-6651945806ee", "comment": "Malware payload (Mirai)", "value": "88e1b8b42761c0496c2181839501dfe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843840, "uuid": "0203d4eb-b3c5-4242-9636-755ef41311b4", "comment": "Malware payload (Mirai)", "value": "ef4767d6fff6516ccfe44b1f656b7098fca3004eec2d971ba69a8fd8796f04e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843840, "uuid": "5f5a668c-3c1e-4075-957a-1a44db79558a", "comment": "Malware payload (Mirai)", "value": "10fcd998386b867820f6226efd7f5f7d95f56d45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843840, "uuid": "2412dc01-55bf-4926-97e7-a9101207bb5e", "comment": "Malware payload (Mirai)", "value": "961c0dc14a6a71e83e6dfda7cb815145d43687e0a60730bc8b60ce83c988551340cf544d606413504266573a0ec4bbca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843840, "uuid": "0a4ea94a-3700-4703-b529-9fd7c641652a", "value": "T172C33A32ECB52D1BC0D0647A01D38725F5E66F0960F4C61EBD620D9DEE391A027BB6B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843840, "uuid": "5a7100e2-ed03-4573-84f4-8d607fcbc26e", "value": "3072:slb8PhH2vP0j1Kap5sCazc+bySK/wFbujTrBc:wY92Ho1KEm1o+byl/obd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765843840, "uuid": "a656ee0f-82e8-427e-990c-b4addf43346a", "value": 126596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765843840, "uuid": "aa321e1e-25bd-4b63-a317-fcf1fcc87129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843840, "uuid": "3b802e4d-471f-43cd-b7af-fadbf958247c", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7365c64-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765896345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896345, "uuid": "1d964c39-6170-48bf-88cd-7c7c6b7c79aa", "comment": "Malware payload (AgentTesla)", "value": "85d28afb3d0ff519f877853b2911387f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896345, "uuid": "d764b852-c846-4d8d-82e9-ed5cdcececeb", "comment": "Malware payload (AgentTesla)", "value": "ef51d0f14a234eab0fd6ab3e7ee14b988ea95558c72238c559e411b0181f6cee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896345, "uuid": "3d8f034a-d559-4f09-adc9-62a976445d20", "comment": "Malware payload (AgentTesla)", "value": "eb192b225b2a3d11d7cdbaaf68201801591aa88b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896345, "uuid": "6ba201c6-9e2a-44d3-979c-f535a5031d31", "comment": "Malware payload (AgentTesla)", "value": "cfe642b938667e91df717580c166450d9f02201a2f74449e1269cbf921e29a542a18f1bacf89d55ac582325daeb4f569", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896345, "uuid": "6c9e7cc0-0b0e-4108-a654-8643f88a00a3", "value": "T1884502118DC42FB9CFAC9A1890BE161DE3F04A8F4456754AFB3BBD46AFB7604120B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896345, "uuid": "fb423422-290f-4d39-90ae-2d12ab928be1", "value": "24576:b5BoPv7a20gPCgja1zBgRsf8ZHsy6P4TtipUaNDUqT1JJh:bULawPpOBj8ZYbtNDUM1Xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896345, "uuid": "e587c818-1cc1-464a-ba7f-d62811b5cc38", "value": 1273320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896345, "uuid": "2692d6d5-72ea-4789-a3ab-91668ad15f04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896345, "uuid": "46db12bb-068b-4452-b226-6da2bd28df39", "value": "PO PUR-2504003.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b34a51-da58-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765873208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873208, "uuid": "44f46d8e-e0cf-4694-92fb-d4c0c055238e", "comment": "Malware payload (PureLogsStealer)", "value": "801b32929be13ba45c9eaa411a33e368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873208, "uuid": "de8dcfd8-6d4b-44e7-8eff-9a972f0d7bfe", "comment": "Malware payload (PureLogsStealer)", "value": "efc587da20be6fc424af7edfd1b1e4fdf05273a1b4acbf955b3303b7b592dd17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873208, "uuid": "20ea2a95-d23d-40aa-9240-9835d34ae5b6", "comment": "Malware payload (PureLogsStealer)", "value": "9bc258075432cd4a2156d5936f1b462fd8b3a02a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873208, "uuid": "14a70c40-8907-48df-9b9f-50652ebde7af", "comment": "Malware payload (PureLogsStealer)", "value": "c5ca8c7b863a156188cdf94da88214450688e68d2376908cbde4a270e0c0fe214a672740bad1e44cc62c955a64100d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873208, "uuid": "1063816d-211f-4a38-82a3-5f868adf9109", "value": "T1F99412C8FDD4C063D25224F1F5AE566AAAF4E80223D18F6B67211F8870A716CD9DD2E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873208, "uuid": "d1f0a762-8b63-49e4-b34f-46b1604739d3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873208, "uuid": "89081178-a133-4995-b77c-d5d7377b4a78", "value": "12288:cYiPMFdFRO2sLMfjokSpu9tBSL53oPETr:cYiOdFRmMbcpu9nSLViEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873208, "uuid": "925da95e-8db7-436a-a08c-13c7180e6e67", "value": 444824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873208, "uuid": "5d6c54c5-299c-4c4f-91a6-f35f144ee3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873208, "uuid": "b1b0b368-54b5-44e7-931f-f61819039180", "value": "Swift103December25-1121-100101294-002894-2002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442485cf-da85-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765892635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892635, "uuid": "56db6c86-8371-4d93-bfa7-810b08db90f9", "comment": "Malware payload (Mirai)", "value": "e39ed823203e2ccdb62a141021553c8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892635, "uuid": "0ebf3c1a-b861-4f19-8314-89dc41a568b0", "comment": "Malware payload (Mirai)", "value": "efe6b4f32b21190ddf0e20f259d91719ecb2ac3df311046835be330bb6bb5024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892635, "uuid": "f8b10569-8fca-48af-8c7e-34971f2403ba", "comment": "Malware payload (Mirai)", "value": "d36e87a4deda549fd23e5c2848d036be4f82413d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765892635, "uuid": "8c2ad2cb-7680-433d-a6dd-9e2236763bba", "comment": "Malware payload (Mirai)", "value": "f9332574d6c10ece6e595d57c61457f1c7dac29291f104f9a678c663c9c5876ec4a910e931a3318ae93abe3d0a02742c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892635, "uuid": "1f270946-1e15-45ea-9b70-2b2d1b0876cb", "value": "T1C4C33B22BCB53E27D0D4A4BA51D38232F176570910A8CF19BC720DAEDE3D53827766B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892635, "uuid": "f2941551-bbcb-475c-946f-b416eb4719e0", "value": "1536:RljnfSaDuqmkjNbDlS2iQE/ZeBhVW8k2a6D4RUNRYXuLsJtS3XHH+Mikn2g3pg83:Rd68NxKy6hMq/Gn26hfjABm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765892635, "uuid": "99ef9f46-66e5-4df4-9452-326d888ed5da", "value": 124108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765892635, "uuid": "48bcae79-5c11-4d0f-8525-709763580f1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765892635, "uuid": "d7a12bd0-41a8-45a0-a8c6-9eaca0628152", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352da1d7-da80-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765890463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890463, "uuid": "11be6ede-6bc5-4f89-817c-356b5a4a2f48", "comment": "Malware payload (Mirai)", "value": "f365b7165241fdd96202b89d9c9eeac2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890463, "uuid": "32b2c2d6-9dde-4ac4-8ce4-3494e707c8a8", "comment": "Malware payload (Mirai)", "value": "efff1b9d59686f1d972857c1b12f885d5f54e3eaf4d0230161d1abe7a6f193cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890463, "uuid": "acc58b04-8aca-4208-b289-8cdf01f0297d", "comment": "Malware payload (Mirai)", "value": "49840fda62913e13efc1a2306607ce951a615240", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890463, "uuid": "72762aa6-5adc-4e3f-8c58-dc633a5dd04c", "comment": "Malware payload (Mirai)", "value": "ce7862c33acd8196bbb7ccf042cac544921a59194730b72b3e83b4c336251b0b3db294bdbf3977a8d4b588781e7a710f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890463, "uuid": "f14f4609-3f6e-46c0-9a48-912803fc9140", "value": "T1F0B3E699FD428B10D9D03BFAFE4B518C33134398E2EE7517AD14AB75778A0670E3A846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890463, "uuid": "d7cb19e5-ca7b-40a8-a587-3074dcb30a27", "value": "3072:8wAMaCPsQaMomVkBCWvVGAFvgKppOxIzmWVnp5:8wA/CPsjMZ3WtGugKvOeKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890463, "uuid": "e13f7b7f-05a4-40cb-b650-385c4c872290", "value": 107696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890463, "uuid": "7fac0686-dd92-45ca-8fbb-172f67c8bcb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890463, "uuid": "486daea5-ba5e-4429-9f06-142fc4fb7b13", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f19c358-dad8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765928194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928194, "uuid": "09b2f0c4-f4b6-4a21-848f-efc5fe38a2a0", "comment": "Malware payload (Mirai)", "value": "0d06cf2faf85de23663872eb84da4579", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928194, "uuid": "f5933cfe-6b89-4a4f-9677-541d2106f818", "comment": "Malware payload (Mirai)", "value": "f059d362eaed97edbf8bf8269ca88ae9c9a37aabd8b359b71b275827f9ff6ab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928194, "uuid": "3d899add-271c-4f5b-b0e4-ceba3e795034", "comment": "Malware payload (Mirai)", "value": "c8f9418841a10a0d38c9ee4d8bfe18e797883b40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765928194, "uuid": "e86a61c3-10c6-421a-a1b5-413dfcd55ff7", "comment": "Malware payload (Mirai)", "value": "dbacb7e00eccd234b4abc46e615e06e929a5fd5d36f6e815acd54680d8967ae907f2618c635e9da1fb9db153a43222a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928194, "uuid": "ea0e3e6a-150c-4a71-97ee-afb734a4c2c9", "value": "T133B37D23815D8EF4E1F84A7664B17D38E322590325A77EBFBAA588D0004FEDAF11E355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928194, "uuid": "746ab393-f5a6-451d-9ab4-35a4de8d8125", "value": "3072:l1d2346fDhuSgGUk4h04EgIebLQyCiWV:l1YrSd2j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765928194, "uuid": "0ec0b409-41fe-4890-ac76-f44cf2cb5373", "value": 112184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765928194, "uuid": "e54e9de1-6d8a-46fe-9a70-08504e99c45b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765928194, "uuid": "059cbb7c-740e-4c49-be89-d0ccb804a0bd", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c8c86a-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879428, "uuid": "d6b0da32-581c-4b44-85f6-3abf6b127e4b", "comment": "Malware payload (Rhadamanthys)", "value": "a07761e92365499eda0748ff0544b485", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879428, "uuid": "2898f936-4f90-49d0-9d49-361b24339ac6", "comment": "Malware payload (Rhadamanthys)", "value": "f0a70c4ad60a4525cea0b4a7648d30fe555d156a2b1ab3864aa3dce70a6091ec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879428, "uuid": "973e8223-50be-4dde-83c9-e3d33d72f47e", "comment": "Malware payload (Rhadamanthys)", "value": "0c48d54a7fc7be0f9c0b3defe1e6029d7ae87cf4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879428, "uuid": "05090aa0-392f-46b6-8a99-ad2f6f0bdd23", "comment": "Malware payload (Rhadamanthys)", "value": "b58584755d2faf65aca8d39108c3f56ddcee37756e343d6099c4fde3d2b0a87c599d418fc4b106a1392bc785d58c5315", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879428, "uuid": "622ef0ec-f835-4ad9-8640-2b304267025a", "value": "T1C9A3C9147F1A0DF93053E3297F4AFEA0855DF66560042254DAB73B9A52E4B0AC8BC7CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879428, "uuid": "816ba02b-ca7e-406a-a86f-f88071dff391", "value": "3072:GDB7b0ZFJiY+J/8X/2i+7rKx6fSvZcQwrsXLA3HMxWKxFl9swKJ4mq/EaZizZ33k:0yFJiY+J/8X/2i+7rKx6fSvZcQwrsXLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879428, "uuid": "52120e56-213f-43ba-ade9-23b7ef2f494c", "value": 99480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879428, "uuid": "b402d05b-c59a-41df-a215-42f3510acbf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879428, "uuid": "203d23f7-af2d-4b9f-bccc-fc323c59d2e4", "value": "invoice-1637482117.pdf (97).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a221a7dc-da66-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879479, "uuid": "54c153cd-8322-41c2-97f3-7f195253935b", "comment": "Malware payload (Rhadamanthys)", "value": "4532170fb5557c79286948fbfc317a7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879479, "uuid": "c3ab4283-897f-46b0-a5e8-e4df9ef31e92", "comment": "Malware payload (Rhadamanthys)", "value": "f0a89c32d9a8f9222d6e12d2f0eb0eaea4b733e28143e3f4942b9b312787a7a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879479, "uuid": "e0bedcb1-9809-44b8-bf8b-1ca80bb66b0c", "comment": "Malware payload (Rhadamanthys)", "value": "b5fe37bd0b1e1fa0ef5c0c70a1e5da0be7fa4b99", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879479, "uuid": "82ca76f9-9919-4926-bff0-9c88dcdf165c", "comment": "Malware payload (Rhadamanthys)", "value": "ac64601d7b8f3089d3741daa3e85f0e814af832e84524899aba434a259f0b732721d72d836555274b43385277430d0dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879479, "uuid": "03bfe0ea-79e1-4480-982c-bd9d8b60c7f6", "value": "T162A3F8433643DCA2DE19F69E5DC11AACDAD6B6898B0056CDA08F73133DCDA2709187E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879479, "uuid": "2a062df5-df2f-4476-bfbd-6e30e051ae60", "value": "1536:GDB7eKg203i/cZrXrE4qx+SUHw/AixifEHS6BkQWJ+aY:GDB7b03iQ7JkoEHS6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879479, "uuid": "c962f307-0310-4f1d-80dd-4e902bba7864", "value": 103338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879479, "uuid": "72042bed-f305-40e8-91ba-c2298f05a0b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879479, "uuid": "25cfe63d-4245-41de-82d5-9cf8f80cc5d2", "value": "invoice-1637482117.pdf (91).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfea02e-da59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765873860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873860, "uuid": "fbdd13e8-cf42-4302-94af-7f30b78b9755", "comment": "Malware payload (Mirai)", "value": "482826158217a6a3bde44f1004341d18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873860, "uuid": "1d640372-f72a-40d4-b19e-aa3451b9e08a", "comment": "Malware payload (Mirai)", "value": "f102eddf34e720a4ed961721a6caea4a881721d2ec084333ac26651c96b57258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873860, "uuid": "52984b71-6aa4-4a43-bc53-bb3e1628df15", "comment": "Malware payload (Mirai)", "value": "35a5992bab5ad39c18b840e166c1de28105ef9bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873860, "uuid": "cb85e280-7021-4253-a2f3-20a1412aaefe", "comment": "Malware payload (Mirai)", "value": "ffd92eef8b6a73e5a7961217c93cd2f9c4ce6c22ec8485d7423ab4d8502821562bd1f4148b16b2de7bf4e0f3b6751b6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873860, "uuid": "9e369453-50ac-47c3-aff1-206a248e636d", "value": "T1DA039E52C93A2DA4C13599B4F421CF7E2B53E959E6532ED6E4268238C013EDCFC2D2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873860, "uuid": "5e342602-6364-4b64-8f6c-6782f1aca331", "value": "768:kUcOetsn+kuY+6y/DN3axGevPIpwIoJq3b7TDC7a:kD/ts+kwN4/PPnJw/TDC7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873860, "uuid": "d009f5cf-3e55-467b-a09e-8d3314dedb3b", "value": 39952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873860, "uuid": "9e54bb56-cd74-4dc6-8fe5-759adfa4dd96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873860, "uuid": "b20a507e-e85a-41b0-9981-b4c4742691b7", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f61f9fd-da86-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765893110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893110, "uuid": "efba4f1e-d445-482f-93cf-1ceaeb8f6156", "comment": "Malware payload (Mirai)", "value": "4a053fb86af328a3a6e376d35ef717bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893110, "uuid": "221f48c7-b14e-48ac-b7f3-f7c81b7b4b3d", "comment": "Malware payload (Mirai)", "value": "f13db294619f79714b834fe02cbebb340accbc1a68579db637eea48aac996fd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893110, "uuid": "38d4bf36-fbc0-4f49-933d-fcbe321585d2", "comment": "Malware payload (Mirai)", "value": "9b4a33d4d5a0173d7fd3140096aea45a80929a5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765893110, "uuid": "0f9d4ff5-939c-432c-a292-17aa15efb4fb", "comment": "Malware payload (Mirai)", "value": "96b2f99a6d22240dc4417fe064378746adeceead52a76978daac162d6ff2cd886a18cab47b8cdf4dcd2e4c93f8c6b1b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893110, "uuid": "6c411ce7-843b-4122-926c-177c8168d878", "value": "T189C32A56BD41DA22C6D76A7BFF9E03ACB33613A4D3EE7107D8245B58738A0270E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893110, "uuid": "a2d99659-b406-4776-b186-de925071bab6", "value": "1536:pF4+rGPTqSA26auNHJSVOJG217clizzrd8lGmttozJHhwsIehlyKdHvS8nTo5Z44:pF7K6hd17clSNbzJHh/pPBPS8n85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765893110, "uuid": "d713b6f5-172d-4916-af35-6acdf3b67e77", "value": 120464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765893110, "uuid": "a9e8c82b-9220-40c9-912b-eeef805b160e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765893110, "uuid": "4508431f-a8ba-46c6-97da-5ea1c4958a57", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70302843-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765896145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896145, "uuid": "aeb0113c-fb0b-4cde-ac06-6d9055003985", "comment": "Malware payload", "value": "b290fe4d45637cdb40960674f0a78fa7", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896145, "uuid": "8004225a-af09-46c6-8833-b77cb1c8db3e", "comment": "Malware payload", "value": "f18056f2b87fcac9aa149f4591d171ef94586fbda620bd60cbed6867a1e9697c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896145, "uuid": "3b3b9c53-033a-4f18-9d64-596f8f107231", "comment": "Malware payload", "value": "f02f733360a8f3908d3f16c782f007ef2f483210", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896145, "uuid": "8db5099b-758b-4686-8dcf-e5329e318d52", "comment": "Malware payload", "value": "a0577df3e32ff0daa9392caeec31b13e61ea922ef65abc367de77756b2fdc84037c99c90066d379a287cf2f2decf7070", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896145, "uuid": "3f1376d0-d727-4821-a95e-1f5669ed2a6e", "value": "T1BFB115D4A9DE1288F2715F34BCFF300619297B6C872B8BE906A9C1C655D131C866FE34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896145, "uuid": "d3ba0db1-5d61-4bdf-9159-8bbc377320e7", "value": "96:8iJFpIu45EOWSBk50+i7syHHWUeGQZCzEJE+CAPxtwwbDmr+n2f59ZgTRi:8iJFWd5DjBk50+usyHH/eGQZCQJE+CA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896145, "uuid": "ebe401f9-dc1a-455a-b4c7-8defe1475734", "value": 5165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896145, "uuid": "2c289a02-5406-49bc-9c82-b66d55da0212", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896145, "uuid": "b05e10b9-c332-47c5-819f-ac00e9adba18", "value": "Oferta_M_Saracco_09-12-25.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4b5165-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879712, "uuid": "1c7d0823-fcf2-4471-9031-9e2c1a79dc1d", "comment": "Malware payload (Rhadamanthys)", "value": "23d93accefb3c6b8dfa0f4833b07998b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879712, "uuid": "b34828f7-5212-471a-aa09-829657ea9b48", "comment": "Malware payload (Rhadamanthys)", "value": "f1a56b34ea53187467fd3accc789a5be1664d3e61cd128e6c1bb7c103f4883aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879712, "uuid": "8a76ddfe-ea4a-4e53-9c59-7a624ecbfc4a", "comment": "Malware payload (Rhadamanthys)", "value": "98271af0237ac391f2b24abd621beec4fca77e0a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879712, "uuid": "fb477666-0529-4255-b244-1ef68ea92e59", "comment": "Malware payload (Rhadamanthys)", "value": "d5d6520d507bbea13714a113554f1ffce51c23bf931f36a9812ea57c9ab0dde84c388f740ccc82ac5d42a2a572de958d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879712, "uuid": "0b8f4960-3a14-4a24-8e44-2b8654a354a8", "value": "T1D1A31AC2FF67A670509171B11C8A48FB6AB951D4EBD5D0928E8EE67049CF8CB3C625C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879712, "uuid": "d0c8a6ab-3a44-48ee-8108-902df76fef5b", "value": "768:GDhd0i7J4sYKgY/CMNfWd1l8WErXcUrS4+MHU5AhDucSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20grbrS4+d5Ah6c6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879712, "uuid": "89575eeb-d50e-47b0-8ef6-5828fce05819", "value": 102660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879712, "uuid": "fe9befd3-274b-4aff-8c4f-7e849533b1c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879712, "uuid": "68383a53-bc2d-49d8-b230-58da49c30ee2", "value": "invoice-1637482117.pdf (52).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f7c59a-daa2-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1765904993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904993, "uuid": "b0fb8652-5a11-4173-a069-adb8c6dfe4aa", "comment": "Malware payload (Adware.Techsnab)", "value": "14caf274ead430e7892bf6280c54cd3a", "object_relation": "md5", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904993, "uuid": "765ebe34-ab08-4274-acc5-9957941d79b5", "comment": "Malware payload (Adware.Techsnab)", "value": "f21809af9cc04144f333ca497e3b1cd5d5431276b9926c50b4c76262ee18783e", "object_relation": "sha256", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904993, "uuid": "6bf099e5-5c9d-4f17-8f7b-efc7ecb2ae33", "comment": "Malware payload (Adware.Techsnab)", "value": "406673226176fc27b8856365e743f6b60d5f867a", "object_relation": "sha1", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765904993, "uuid": "2cc24bd8-cbc2-4b5c-8f66-0332b35f91ae", "comment": "Malware payload (Adware.Techsnab)", "value": "4d9cce435d3416916a1f15ee37a49cf6bca9b71f8593a148404b777ffa57e58b5ffe4dbf9c141a621309fedff6fbc48e", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904993, "uuid": "0014f860-b2bc-432e-8987-063642577e94", "value": "T11AF4FB12BE8FDE7643D2EAA3E6E3D108FDA4A08D51177AD8B1DCC5C65030E951788E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904993, "uuid": "d573def2-e7b6-4d3c-8228-8c4e3825bac7", "value": "12288:55MJwEZXraZnhgXiOul3u/quWgOyrDgiun+PwaLC4YdwRFSSu2:55TEF+Bkie5QpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765904993, "uuid": "6fd6de1c-2c16-497a-b87c-abaf70c21446", "value": 731808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765904993, "uuid": "b384e874-a24a-4bf7-b2ca-ae5bf04eb704", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765904993, "uuid": "c3b88ea3-0e51-41c7-b168-0f3872740863", "value": "h2n8xaan6sna.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaefade9-da96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765900109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900109, "uuid": "41e110c9-95e4-4c01-a292-8a6850112db5", "comment": "Malware payload (Mirai)", "value": "7415d589460c8abe4f82877c46c1156b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900109, "uuid": "22f7ab73-488f-4d84-a8f3-215348b83d1a", "comment": "Malware payload (Mirai)", "value": "f2a1b78a2d11e3b6358deccd95e5bf74e8c14323f3b6f5ca27d32a203fffa1b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900109, "uuid": "9de1f19e-2b34-45f3-add1-32cc8ab81f2c", "comment": "Malware payload (Mirai)", "value": "6828159580118cb0d6a6756a7a8ba3ac7c243f1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765900109, "uuid": "45c2dd59-4aea-4edb-aed7-88b4ad055e89", "comment": "Malware payload (Mirai)", "value": "20118bce840c132b569591ceb15af002f4be506e87a13adca091bb5a22face02507c3909c420ed210eacb46ad4768a0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900109, "uuid": "65bfe04e-60aa-4811-8ebe-1d1ed49be03f", "value": "T13D644C05AA418E23C5D517BAFAAF02453333A7A4E3DBB206D9185FB4378775F0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900109, "uuid": "6fa10e10-7818-4235-b8d5-c1a2d73402b5", "value": "6144:TGlyhJkbnt6KMtSEOu3cu1k/hmHXa8WMdfXTRY1R3qgHDzC9CM7n6JzM/RDswmko:LhypRMtSEOaT1k/hmHXa8pXTRYLZHDz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765900109, "uuid": "e3bbf8f1-dcc9-423c-aa01-20609054f89c", "value": 316006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765900109, "uuid": "3a947c32-bfba-49fe-bd72-6c80657d41c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765900109, "uuid": "045a9540-613d-4bb2-a773-0fe15ac7aebc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e12ddb9-dacc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765923146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923146, "uuid": "66bd1859-c0eb-4f6f-9901-c342bfe65bea", "comment": "Malware payload (Mirai)", "value": "0d4712e636ef5517a4f79c5faf265bd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923146, "uuid": "3140c274-db9d-4186-81ec-9f253f1babe9", "comment": "Malware payload (Mirai)", "value": "f2c24feec37be6acd811af15fb4bcb78a4fbb9dde81807f1cc7ff4709edd4efe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923146, "uuid": "3217bdcd-d464-4aa5-810d-ccdf9c4621a4", "comment": "Malware payload (Mirai)", "value": "5f289acf5603a4c593f1da025876cf569530e63c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765923146, "uuid": "34e2350f-b442-428b-b31c-79938337b73d", "comment": "Malware payload (Mirai)", "value": "678c95458fe072cd1a117f572a3a91af2329598b0265f49803a837c27bc7d15cb496859962fa0ccd4680add63716aa90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765923146, "uuid": "bca78169-0070-471a-99ac-47989666d15c", "value": "T1CFD48D99FD5E3D42D2C7E33DDF8947A1222B75F4D72742B22A41024DE8C6EEC8BA1215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765923146, "uuid": "7802b5a8-398e-468e-8ab7-6f02a65f80a6", "value": "12288:LxkzXwjHAL2Rh5phmsSTx6tU/6mBGqYgFvpGp39s5qz0wIJmPMJ:wagqphah9sgFvpALM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765923146, "uuid": "40515002-b2c2-4797-93f9-69f10d72d571", "value": 599784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765923146, "uuid": "cc19193c-a26e-44db-ae0d-87bbb7618236", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765923146, "uuid": "f0aaf743-597e-481a-8756-56b6e39e2a12", "value": "shadow.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e8d6a1-da76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886303, "uuid": "b9435e6c-126c-4f4b-85f4-8ead1bc4c051", "comment": "Malware payload (Mirai)", "value": "3505aaf2d3fa4b794437b8289bb2d33b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886303, "uuid": "24e2adf1-05ec-47ed-8b4e-463d818a4184", "comment": "Malware payload (Mirai)", "value": "f337cd141709fd5692b609e1c759dc633e96282d70e6fac635ebd25001424e0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886303, "uuid": "23a797da-b9d5-48b0-ab19-d1acbdb4045e", "comment": "Malware payload (Mirai)", "value": "4b3d685e58682828bf976cdbcdd69638bfa0eb74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886303, "uuid": "916566a5-0067-4fb7-aeb0-fc8b1a7296ad", "comment": "Malware payload (Mirai)", "value": "76ec343ce1900e7a05fbc6cc54641c432d79140eda29db05dea7a00b1ae976c3a6e9bdab554ebd817bdda2a9e29fdbc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886303, "uuid": "bed0601b-3fae-4555-b5bf-b4fd7a277cec", "value": "T19B932A96B044CCBFF90ACA3A99BB46157D24F5403F416E27F65AAC93B9290907C3DEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886303, "uuid": "50fe68c4-141b-47b3-a9ff-64cc76c7d780", "value": "1536:uOERe2MI1WK1KabQOjPESQhC8uC9PbJbNGS/f5T8M/qelMLWFvA:uOEuK1KtOwSMTXbowf5T//pM6Fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886303, "uuid": "24c387e8-dcd7-4477-9043-354acbc46d21", "value": 96460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886303, "uuid": "76d31ce2-5de9-4ab9-959f-a99935cdc5b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886303, "uuid": "a8a2e6f3-1bbb-4aa0-8281-6f94becc64ac", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd425e01-da80-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765890691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890691, "uuid": "1e0f1da2-c65c-42a4-b44d-801de4dff1c1", "comment": "Malware payload (Mirai)", "value": "e46dbdc77aae1310dc356feb7cccf74d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890691, "uuid": "02dc1551-90a9-461a-8c4d-2dcc352dc39d", "comment": "Malware payload (Mirai)", "value": "f367b003d782c9b8b07fc4b214959a3b67b05dddcc1c617cbeab360b25f84ba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890691, "uuid": "c871084f-3e34-4308-bcd6-f79befbdb7fd", "comment": "Malware payload (Mirai)", "value": "a67e373a267df040d9b6806d0405d549c0a9fc60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765890691, "uuid": "6a2660df-119c-40ad-9051-02fa2e0c7087", "comment": "Malware payload (Mirai)", "value": "38984ccb27f18982e719dc0f98f54e1fae7ca9fa9b3f43967094635555cf7f70a2bd706e137a3d98a1c57a912680bdc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890691, "uuid": "bd571270-6e15-4d93-b6af-9fbbf0888a25", "value": "T176B3F724ACC49B15D5E723BBFE5F118C33166F98E3EEB016D8102B65738A51B0F3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890691, "uuid": "af9f2f04-18f2-4270-9af1-450f095b24d3", "value": "3072:sosW1w4K3JciAcZ7D+xDVonKph+ZX5POVns5:9sWDQJciAm7SxDVonKpheXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765890691, "uuid": "b28f7ac5-3603-4757-b2ae-97c5c825f628", "value": 112820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765890691, "uuid": "0fa55150-01c9-4a2f-b2a3-57c88aed76eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765890691, "uuid": "370abd95-5b47-4676-95d3-11e06b35fd29", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af794eb1-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879930, "uuid": "eb9b11ee-9fb8-4e09-beac-776a3f6ba82d", "comment": "Malware payload (Rhadamanthys)", "value": "94d11d501935bdf87159fc25a32c95c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879930, "uuid": "81f1ac49-aee0-4c61-8fea-026d8661b769", "comment": "Malware payload (Rhadamanthys)", "value": "f383c3a7006fac30d722e4a1f8f59723248a139f86b8dd24fceeae76f53c047c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879930, "uuid": "957ba097-a182-4b90-aaaa-c7be0dff4dce", "comment": "Malware payload (Rhadamanthys)", "value": "40bac310ca201a2eb4946a903439914ddcf39e52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879930, "uuid": "c9cbd5df-cc65-4017-8244-462ca9220afb", "comment": "Malware payload (Rhadamanthys)", "value": "b511fbbc4839b76cb86792eda6ee8c012fbdb2eb5e5e82f3b310e1815df820a39e5ffa98636b0ab8b7a23ce59c133299", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879930, "uuid": "84ca3919-04d3-441f-a99a-e94b24de3991", "value": "T10DA32A349FB66C522AC3F8C22EC89EF2DB44B4486AD9309E055FEBBE03747A525115D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879930, "uuid": "f520d5a5-6838-44f7-8bb2-8545c0ff7376", "value": "768:GDhd0i7J4sYKgY/CMNfWdwtBSWKrXukriKSiHMeGAB1y3LSLAuAAroQW+FF+Ec+p:GDB7eKg205rtriKS7eGABE76BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879930, "uuid": "d4eaf962-7d76-4dbe-a361-6b16d29c1258", "value": 102118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879930, "uuid": "591b6fb8-557a-4644-8050-56f10a27d85c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879930, "uuid": "8b3d9168-6940-48fa-8b18-605124a8a80f", "value": "invoice-1637482117.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed45842-da57-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765873084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873084, "uuid": "02b44344-eefa-4e56-86b0-77c663590491", "comment": "Malware payload", "value": "205bfb5fd9635e83d16a9e865125b1ea", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873084, "uuid": "3001afdc-3208-457a-815b-20f008ac9af5", "comment": "Malware payload", "value": "f3d8d6ffdb3efa35507d789e8443fa0da35da16f802d82c567235ce9300218fa", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873084, "uuid": "cc7d8520-54ce-47a5-9b18-8a630f440aed", "comment": "Malware payload", "value": "81b64d79e46916c465c1728a933cd5ddd9463409", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765873084, "uuid": "6b38b2b3-4789-494f-944d-94c2649459b8", "comment": "Malware payload", "value": "d073a1e8d63ff14378055f97e3df01b08b925d1a36ab2940d29993e4f7a7605c0a221c284458c15188b0728800af1c34", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873084, "uuid": "5def5374-191f-47b8-92c9-d1970f51e199", "value": "T1F5D2E9023F41709BE5A1CE719BB3EB9529687C92962109B43F80F75B7BFE491D426238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873084, "uuid": "509b9db5-e04f-463a-8f07-271d01b5b7d6", "value": "768:RfcFn/H3kGlDclnJH4LPCHodjHp2Y9fHh/wCtttttttttttttttttttttttttttJ:96XTAJUaINHEY9fB/wCttttttttttttj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765873084, "uuid": "1f1106d8-5245-4c45-b6d9-86a9a3783cc2", "value": 28682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765873084, "uuid": "ee8f7d58-be0b-4549-a9b2-550576dda0c6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765873084, "uuid": "50ef78d7-fa28-4d74-9209-f1dced062d7e", "value": "Comprobante de pago (TRANSFERENCIA).xml.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50a08e2-da7e-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765889845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889845, "uuid": "76361553-4a6c-4a6f-8ffa-0b01e677893e", "comment": "Malware payload (QuasarRAT)", "value": "8bc01316043358e3d72ddfd63b51641c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889845, "uuid": "13963ff3-dc1c-4a18-8b66-79d90d306648", "comment": "Malware payload (QuasarRAT)", "value": "f40561adc431dbe85f97c66089b2604c5af187864f70d49a144f2e4dcf41d7b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889845, "uuid": "78ad5474-aa6d-44c9-aad2-4a8c6c258e3c", "comment": "Malware payload (QuasarRAT)", "value": "134aefb454f73f56b5d08fe420393b74fb3f89fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765889845, "uuid": "45c710f3-3e5f-4362-9157-da2cf004c18a", "comment": "Malware payload (QuasarRAT)", "value": "34802e5630ede42a1509d8482af8e79c0a2a4dc19bb6c39f35b61bc9c6d7e3293a40a29e388304fade1dad76f7aefb39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889845, "uuid": "ef5ddbdb-c634-4436-b45a-3ab9a0b54eb6", "value": "T10F746B1363A8EA3BD1FE177BE03206155BB0D406B716E38B6A6855FC6C123868D917F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889845, "uuid": "3ad79554-6b4b-40c1-a607-ed2030f258eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889845, "uuid": "cd8e1c4d-e46c-4f8a-b1f3-5987b0e015fb", "value": "6144:pq6bPXhLApfp4iOM5KjWtnbcOUkTm93x4Vl+M3aVAOpgK:smhApMMg6YLvpx4xqVNpgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765889845, "uuid": "004106ae-8d9f-42c0-bf11-d9b9a5997954", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765889845, "uuid": "8045c0fd-c0bf-43b4-b97b-a8a2d45fd1a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765889845, "uuid": "e234af00-e933-45fc-a008-3d2a0d189e1b", "value": "f40561adc431dbe85f97c66089b2604c5af187864f70d49a144f2e4dcf41d7b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a56beb-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879723, "uuid": "504ddedd-48d9-4097-9a0d-9a0186333f6f", "comment": "Malware payload (Rhadamanthys)", "value": "8a29ae49db28366cb1f230d7b8ea3452", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879723, "uuid": "bf42eadc-27cd-4e93-9953-0cff4aab9de4", "comment": "Malware payload (Rhadamanthys)", "value": "f417c56fa92040f8e74800b8cc179657443e0fd370cb1e2f2fca01805681f69e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879723, "uuid": "67023f72-9422-4abe-bc65-f14b8a9f9252", "comment": "Malware payload (Rhadamanthys)", "value": "72060f38e4c5e6f3f05c4809ef5e0143d90ec35d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879723, "uuid": "377b35e3-aab7-4471-ba5c-4f25de1da720", "comment": "Malware payload (Rhadamanthys)", "value": "d3cbfe6f50f3e549eda48e9df7a3f974db9eac3ad4654cb2cfd4f260e40551d5b6274ae0cf4bb2926cf01075aa49c36a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879723, "uuid": "449b5b34-a698-48a2-b96d-b7994589b423", "value": "T17BA31901F613FCF566CADABD359DB4A94C8B8E51822B2704A707338424C73BD8D6A6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879723, "uuid": "c2e2f622-d46d-4b8b-ac51-8ba3e811707b", "value": "3072:GDB7b0Zkod/ZmNSuY4ZB7QSBhnws3edpqtJ9+oeILWlVWiFuBg0gzVOEI3Uk1SP0:0gkod/ZmNSuY4ZB7QSBhnws3edpqtJ9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879723, "uuid": "284e4821-dcb7-4f0a-bb5e-4cad7130c27f", "value": 101453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879723, "uuid": "5d7ed0a0-8c69-4943-86ff-d809f6088077", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879723, "uuid": "65366290-6c7e-4c5e-84bd-6363b9ecf980", "value": "invoice-1637482117.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb0739d-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765852785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852785, "uuid": "705c48cf-fa85-4d14-9af7-4dc3c3fd599b", "comment": "Malware payload (Mirai)", "value": "f00add0beef965a149bd72aaf7a73ee1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852785, "uuid": "ee8c542c-a4dd-437e-87b0-2d643c4853bc", "comment": "Malware payload (Mirai)", "value": "f44b0e8f670f215697c7df7ff35f8085482e85d0b9071a802499651315d35a55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852785, "uuid": "b4f0528d-9168-42ba-a095-c046b37af07a", "comment": "Malware payload (Mirai)", "value": "17de980c7e7d984727eefddb5254867b2d6ff26f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852785, "uuid": "9b5b1681-3e67-41ac-b9a8-af825dbf9669", "comment": "Malware payload (Mirai)", "value": "a8cfc636aa1c7d2fab775e465cc8d9342d538afc90767be0dad56aaa1b337d64bc0c9b9db1ce4badee4436529c418d94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852785, "uuid": "f6ee2c35-bf37-4696-9c42-bc04f7d8242b", "value": "T17AC3A52E7E22AFBEE16882310BF75F7087A521D637A19342F26CD6581E7128D1C8F754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852785, "uuid": "6ede1d3f-2047-495d-9661-a5f50f934c89", "value": "1536:HbDwVYuaKurNAV2rKQ7j+4GeGISeG+GX8J2rKQnGx7M/wa5zIXp3xJJoPxejPb3q:QRGUwaMNoPsPb3SrmthjF71Dq1MdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852785, "uuid": "d77222ff-c062-492d-bed2-795143fbd844", "value": 126307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852785, "uuid": "b7c1be4e-e03a-4684-a4a2-86cb624f85bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852785, "uuid": "fd35984f-c7ac-4d89-8196-73ac186e50d3", "value": "Fantazy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1e3b84-dab1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765911761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911761, "uuid": "145d6253-fc9c-4fcb-9047-7cbcaf47d457", "comment": "Malware payload (Mirai)", "value": "79743f1bdc4719d8ceb706799ef26c9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911761, "uuid": "a6573cf3-740b-44db-a336-25254d38f828", "comment": "Malware payload (Mirai)", "value": "f50820b3f0bd90590ce9dffe2b7a18afb908455c72fbb5eda9497d3e452c9224", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911761, "uuid": "be3a81ca-d7a2-4068-a5e8-c1e41f5cf50a", "comment": "Malware payload (Mirai)", "value": "e78198861cd00f31044390660c54be85baec608d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911761, "uuid": "978ba8ff-626f-4ba3-a5b8-8e3f41ca89eb", "comment": "Malware payload (Mirai)", "value": "2af839004f00eac3a0605f2d0e6096d3dd297d8548db30fd6f04560a36bd1456c59576378b52be9477593a26d03efec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911761, "uuid": "9e2df0bc-5337-4781-a3be-e5add9c0a9e3", "value": "T1A1A38D228048CEF8E1D48B7674902D38D71279626A5B6EFF59F4C0D0148BB9BF58E397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911761, "uuid": "350f3b70-4d92-4511-8d96-46cf68d55c64", "value": "1536:0hSJbJBzhM6JR46ZvRKSmxgDaMyNqqVUtO5RPCF7d3HCghVRBV:0MJRTo6ZvRKSmxg2MvtmRPEhXCgXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765911761, "uuid": "81360409-4335-4110-9150-7180d6d0148f", "value": 105324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765911761, "uuid": "8275a3c4-f85c-4648-9fee-5cb9f3d05f38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911761, "uuid": "ff37b323-41f5-40f1-8bb8-f0252638fca4", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90195dcc-da63-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765878160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878160, "uuid": "3e69f231-508f-477e-a172-d6976619d8a9", "comment": "Malware payload (AsyncRAT)", "value": "729465fa2eb3f7d8b2f15bd9f4bc8c1d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878160, "uuid": "78893465-0420-4ac5-894e-7c1411b25989", "comment": "Malware payload (AsyncRAT)", "value": "f5bc4077fe0cbefde57ec3adedad916a743f1bb3046cfba89365133cbd096585", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878160, "uuid": "be9291e2-1185-421d-aace-22627092b3bb", "comment": "Malware payload (AsyncRAT)", "value": "72bcecd361a50c7272dd6b79393430078071afe1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765878160, "uuid": "5fa5c897-ce4b-4549-a34e-96f367244c57", "comment": "Malware payload (AsyncRAT)", "value": "cc9167d6ddcd7713737d7665e90130cae1867ed9a0ae4a7e2542f67f88d14aa1c1e91951504ab48ff3791bb6c07e9e6f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878160, "uuid": "fd60fd4e-bccf-41ca-b6fb-da584ba8b32d", "value": "T18746F105A3DA0668E867D770C7A78332E3B0B8951739C64F5259D70A2F37BC19A3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878160, "uuid": "21e5357f-8768-483e-8e07-76af2c0aecbd", "value": "5eeb4e6016182a1ff6b29a418242b552", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878160, "uuid": "028b4197-1346-4dd9-93d2-cdcb43ddf612", "value": "98304:cleZIQ/xhumBfCPNE8NmsmFCamVWRSvazcFJJsv:cleZI4R1Xm4sJWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765878160, "uuid": "0b9cd381-1cbb-4577-b109-5d83096af7c4", "value": 5687808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765878160, "uuid": "fc07e7c5-5f3d-4a96-a07d-3af6307d534b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765878160, "uuid": "23c87e5b-88a6-451c-9b0a-80f621c9a67c", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c325647-dac7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765921049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921049, "uuid": "fcf847c8-485b-4963-b566-d0470e2b0424", "comment": "Malware payload", "value": "ee06d030915ad8c2d1c1a08d6b3eaa2e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921049, "uuid": "1ea7f467-27d2-4d75-a2d9-683ba34ab0b8", "comment": "Malware payload", "value": "f772a89fd70aa30f456b016d679f8fe62860e5f1a5a3b494e9ff8e6fd143fc8c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921049, "uuid": "ac8471db-535b-4df8-a0cf-429e71d008b2", "comment": "Malware payload", "value": "440c59e17f46ea1a6025cab3306f11f1cd3315d9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765921049, "uuid": "361b228d-41d4-446f-905b-13ef03a8c414", "comment": "Malware payload", "value": "5b91ee46010ac9c342ae6a5c84f4b13ccdd464b01e35a7acd8df79eeb2fbb8a841dfcbbf6c2f64584fd58529c7974b04", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921049, "uuid": "055d0b83-5c4e-4c1c-a1ea-e7448565f3b1", "value": "T1F22533A9A514A00FE2D71E7CCCAE26BCA36D9C15DB5810527BD3B2FFBD73A0052905A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921049, "uuid": "1a1cbd5c-0238-49ca-9b6d-30d155ca74e4", "value": "24576:Vi2igWQ/sxILKiBGnkdy/vLR08iLF1QlTIrSLD6K:I2BzLK/8ynF0PF1lo6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765921049, "uuid": "cd68035c-72e3-47ed-8c99-6b8c8cb20e0d", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765921049, "uuid": "bd6a5df7-02c7-43b1-a630-0473698cb642", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765921049, "uuid": "7e1ac141-adc2-4c87-9391-ec9708e34fa5", "value": "wth.malz.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a416e2e1-dabc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765916419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916419, "uuid": "71d9db66-d754-43b3-9396-2636e4cd5549", "comment": "Malware payload (Mirai)", "value": "62e5e877560b97a603a3c28e2c553eb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916419, "uuid": "25a25948-859f-43f1-ae8e-cc4f1bb561de", "comment": "Malware payload (Mirai)", "value": "f77b502820be9ed053e789187999efaa986ea391fa4124e765c59f821b32fa7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916419, "uuid": "e1cf56df-85f8-4964-a38a-6640412c2010", "comment": "Malware payload (Mirai)", "value": "93f2bb02b35f5493609914abda052b1ddc51b625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765916419, "uuid": "5c978859-128d-47da-b4fb-1ca9ba96b768", "comment": "Malware payload (Mirai)", "value": "cd8c4694836f84498396e6c420359923b0bb30cf128e8ee638525d99495a45ff2269a9202aaccc145fcdafc808516180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916419, "uuid": "a8ebf787-419c-40fe-a835-877cb02a473a", "value": "T1B7733A793A46F63CE9A590B8F44329D525220A083FDCD5E37C836036BF71B89716CE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916419, "uuid": "a2116b8a-7aa7-4227-9a9d-77db5518b89d", "value": "1536:fUIbFv0B4ahtuOtlG3gDMtQVBIVCCfy0K9uf+gn:fUIb10B4bOPXDpuhWgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765916419, "uuid": "e1effae6-3914-4403-9cdd-f22ac47aeca9", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765916419, "uuid": "316fb392-d209-44df-902a-d2fa3b04ac9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765916419, "uuid": "86f64e1d-f878-46f2-8325-f7fd75f4a61e", "value": "Fantazy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eef23b-da13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765843838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843838, "uuid": "0a700f61-36e5-4818-8cef-42decdc78c1a", "comment": "Malware payload (Mirai)", "value": "c9c905d059ad01bba99f98438b0be26a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843838, "uuid": "04a9e7ac-5cb7-44b2-bdf1-afe5d7c34718", "comment": "Malware payload (Mirai)", "value": "f88f6adad4ac8aa7dda6f43723001e5af36d84a1a55794f01f360747a0ef1345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843838, "uuid": "be9caeae-06d3-4978-8837-a4430218bd73", "comment": "Malware payload (Mirai)", "value": "497f0e8f5a8ca49ac15fa8033dfb203e2b536957", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765843838, "uuid": "fce79324-dd33-492f-87f9-b0b8549c283d", "comment": "Malware payload (Mirai)", "value": "de6ecfebe3621c915e1cdfb3139088ad304d28ea504fd0bd6dd2850b564c66f3c5993e1c3a69e7e79c23ca873c2ccc67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843838, "uuid": "a3535732-c6d1-4de3-95bb-c95802347f70", "value": "T18DB31904BD85C613C7E3A3BFFB6E529D331653A5E3DA3107E8184F56339B01A4E6AA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843838, "uuid": "93459442-438e-4fd4-ad0d-6e251e43daf8", "value": "3072:87lKPy5GQCVYEzC25lHuXcuBU08l8nb95p:olRfET58BU0QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765843838, "uuid": "a3ecb546-c6de-419a-be84-a9a11184a358", "value": 113020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765843838, "uuid": "ee769ff4-0363-4b66-b119-30d4d79533db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765843838, "uuid": "5b891c92-6e54-4100-8545-ec535c27eafa", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a07a74b-da8d-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765896215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896215, "uuid": "854e95b1-a96c-4cf8-b4fe-3d15494c859a", "comment": "Malware payload (PureLogsStealer)", "value": "4f6cfc7c818bdb03efa850a8060e9afd", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896215, "uuid": "9d2e8547-1dda-47b5-8bcf-d1022a37dbeb", "comment": "Malware payload (PureLogsStealer)", "value": "f901a95c942c28ab8a1871f04a1ce0a6d36d1eb795f6e00e0b8b7836039ba6f8", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896215, "uuid": "367cbe5b-3c3a-4a19-9435-662f90f61a05", "comment": "Malware payload (PureLogsStealer)", "value": "5f9c7ac35098945d85f75d5c08bbae06fbbeffd3", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765896215, "uuid": "a96a38ec-a074-49a8-a165-ad1a2fe27daa", "comment": "Malware payload (PureLogsStealer)", "value": "68f3bd1e78d3168f3d1738e5810246145564031bed803bda80d34984200fef94dfa5e5034ccec61691b80b4b02b6d702", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896215, "uuid": "cf324f6d-0e8d-40e6-8ba7-d4c71e32fbe4", "value": "T1C0E41230424B3790E3DC9D1AED153F0A34778D964B86CD9D87B3E9391431E26B8E3A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896215, "uuid": "f86e71c9-e30f-4d54-a3f9-9987110f16fe", "value": "192:dttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttO:szcaxHhzeU07rt3Ht3A/zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765896215, "uuid": "9b676e20-a5bc-474f-b218-5af86ba14cea", "value": 673011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765896215, "uuid": "8799211e-d4d8-47c0-a914-2da14b4d99d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765896215, "uuid": "fc5cef16-0996-4776-b297-8ef87d2e9875", "value": "SKM_3165170_2025_16_pdf .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19532253-dad4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765926494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926494, "uuid": "99d659b8-bae3-48c9-a028-e785b406a127", "comment": "Malware payload (Mirai)", "value": "55790fefa3f938046bb00c0afb989981", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926494, "uuid": "b29aae53-c1e9-4014-beea-7d777e05bf21", "comment": "Malware payload (Mirai)", "value": "f9215be57692f2d9280d9339eba752dd6e636af900917a3f3b61557f6f32ad5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926494, "uuid": "67544303-43ec-49c8-9ac6-a27b93886442", "comment": "Malware payload (Mirai)", "value": "20497ac519c59f98952e86f7864f7b263ef46751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765926494, "uuid": "9510c21b-e8c5-4fb9-a95d-69f33bd04a7c", "comment": "Malware payload (Mirai)", "value": "ca114c7dc999f930fa91c33b91d4f68110ef2f96dc2ae60a6b5372755e015530e0a13a7aeef0e79c75f25bb319fead2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926494, "uuid": "1e091952-b907-42f1-9927-0c32358fb93d", "value": "T1C5B35B826006CD7DF50FA63A81AB4A29EA30E2409F420F27F572FD97AD361947D2DDC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926494, "uuid": "e7bde094-ef76-4ec8-84cd-13c0099b4c1a", "value": "3072:+HWhCE+HeP6S7ujQ+8XJB3tvnWlSGFrMB:tf+HePZqVKB9vNGFrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765926494, "uuid": "3b7d96cb-851c-46d6-b568-79d89960cf4b", "value": 118116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765926494, "uuid": "b3ed57b7-94fc-4902-a8b8-8163adc5f770", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765926494, "uuid": "a17a8d98-bdff-4800-b7aa-5d4bd871f8cb", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a516e57-daa4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765905853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905853, "uuid": "6bf39fea-ad78-4306-81ac-d058c6a2ed40", "comment": "Malware payload (Mirai)", "value": "4cbdd3a1fdf96d09c7db5f6b2bcae12b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905853, "uuid": "06782792-3a0b-4db6-bbd5-e82dc260ac95", "comment": "Malware payload (Mirai)", "value": "f9d40c0c1149f97bf691a83baa2f8ea699f7163c7f7002641a78d3ebbe0c2a7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905853, "uuid": "d3e42c95-bd6e-44a0-947d-a6435168a487", "comment": "Malware payload (Mirai)", "value": "aadaae1dd206f283be44631f7d9dcb0f64572fb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765905853, "uuid": "d380424d-14d2-45d3-9869-320449898cd1", "comment": "Malware payload (Mirai)", "value": "e993268af23879399f2a18952a1669cdf58b5f7bb7ee352011fc8b567a58d8554f600fb8b9f7aa9b5e8f68324e2b1a70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905853, "uuid": "cc629140-4a11-4a67-aad0-6d2ce680d4fa", "value": "T177B39E72C849CEF8D8994AB474E5943CC7125A413D5B1EBE5BB984F00483DAAF98E373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905853, "uuid": "c0fd9f45-b7a3-46e6-8dd6-ae0ce5e1af4a", "value": "1536:mQSJWVJuPi2LVxsgQ71q7Te+XzXI2BU6F5wv5yCaUoDsCaIV:mQVIXhxsgQ71q7Te+o6Xu5yf/gC9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765905853, "uuid": "ff284d31-0b02-4f0b-93eb-a19999b473c3", "value": 108652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765905853, "uuid": "4439c581-36c8-4c83-b9ef-be9d4bcc48cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765905853, "uuid": "41b101d9-dfdd-4261-b3f6-903bfcf7df1c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3648c41b-dab8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765914516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914516, "uuid": "062a8f69-7ae8-4142-98b5-1a6eea462168", "comment": "Malware payload (Mirai)", "value": "f38d1da35ef05fa42eefced5ae766961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914516, "uuid": "93cc8f07-65b5-4784-99f0-2220b2ddf662", "comment": "Malware payload (Mirai)", "value": "fae406d821c8898c1a48f149544745a495b4aa01aec86055cf254feb615188a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914516, "uuid": "ba274cc7-887a-4f68-a509-7524471991eb", "comment": "Malware payload (Mirai)", "value": "6e8d16861b542a5379caac5bea170fc78551de12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765914516, "uuid": "386a1ef6-1a59-4cef-a6ee-7a78131f719b", "comment": "Malware payload (Mirai)", "value": "c8aebace2ea09ab856af24118708baa2acd8a2a97b2d47d856c24b8c0d53609fc4cd9737c1098cb6e6b0120901ab9688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914516, "uuid": "f05da801-ce64-4108-b67f-a1e5e6cefd4a", "value": "T1BAD3F8556C418B27C9D323BBFE5E118E331263A8E3EE71179D146B58B78A0270E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914516, "uuid": "f2542af2-4bd8-4e62-9055-b31920bca0e5", "value": "3072:fboSHj/bTeeyfLll5GJG1Sb2QZ1T35VnKz5:fbfHjzTeeyfFGo1SaQXb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765914516, "uuid": "c5059701-f7e9-4a6e-8181-ccffdae2b694", "value": 132288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765914516, "uuid": "aaaa81f5-100b-431f-aa92-7af1d95d3e36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765914516, "uuid": "d7efb409-eaca-4b95-9ed9-8ba22054630f", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3943cc9b-da89-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765894335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894335, "uuid": "445a3506-29dc-464b-9c87-6f9ab6f95d6b", "comment": "Malware payload (Mirai)", "value": "209252ae4ee32622d4651bb7ae4b9906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894335, "uuid": "dbbeeb02-0dcc-40bd-b02a-1bd9eaeaea36", "comment": "Malware payload (Mirai)", "value": "fb33558e24dd56df85ad4abb63787ff946554974cec2677ca943a841a934d484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894335, "uuid": "adbea762-e989-406f-8438-8a61b751611a", "comment": "Malware payload (Mirai)", "value": "e3656c3430460efa4157cace60dfd4cb8567eea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765894335, "uuid": "7ebcfb37-2547-4993-8da4-0623d7d8619d", "comment": "Malware payload (Mirai)", "value": "ae26d04d077a1df8acefbb6768ea34ab4e604ce5abafd1790dcd3250d6a672e8e91d12f5cc76b02ebaf7408ffc090a1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894335, "uuid": "f452028d-3f14-49b7-8281-b1eb4bdc8b31", "value": "T157935C2288175EB4F29D4EF5B8D00538C71315422E976E7DA5F284A04687FAFF90F3A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894335, "uuid": "453131e5-6b30-4887-8713-c56040ebe1a9", "value": "1536:JTQv2dUxOdhhzS4KAI2+wrdjwJyUnJ5Bh39C0i2g7BCaIVu:/exOdhhzS4KAIBnLT39ZittC9Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765894335, "uuid": "1d05dca7-c4c4-4cd3-8a09-5b4d3d0f4eb6", "value": 89940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765894335, "uuid": "e040b1a3-f83e-4466-996c-93b7bf38446f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765894335, "uuid": "36f59c74-4de2-4993-952e-be4b0e511ef0", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b05eda-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879694, "uuid": "ec10e1a4-268d-4f62-8abf-969d7501412b", "comment": "Malware payload (Rhadamanthys)", "value": "6c29d5de42a9a9d27731ef4d12fc3bee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879694, "uuid": "b4560c4a-6c84-42dc-b3ae-fa490b2c3fd2", "comment": "Malware payload (Rhadamanthys)", "value": "fb6ece2fda1787cb9a002da35701864dbdcaa6738a20fbf3cf7c10412c3733d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879694, "uuid": "60cb6d17-6a44-4751-aee7-591c8e9c44f8", "comment": "Malware payload (Rhadamanthys)", "value": "1ac69c4e4354e197528f2270a4563087f6a16c68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879694, "uuid": "008ec960-1c48-47a7-a36b-12e639916b45", "comment": "Malware payload (Rhadamanthys)", "value": "3c66e66e4f8a8169a66e47e0d2b63c5b8b5cebdf26fabe87befe172de008684d83450c5816186b81b232e7354be494ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879694, "uuid": "76e7a631-b9fb-4ef3-a529-7ae46efabe15", "value": "T14EA30A021E17E8B018025A411C1599FD8ED80F6D95EE31EE6EBB3F42C395ADE5E901EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879694, "uuid": "ecbcc87a-fb69-47a5-9664-72922855b04a", "value": "768:GDhd0i7J4sYKgY/CMNfWdrx6oe5DAcZFQB6DbzWq+Y/bJKrJVMnbHwiqzrw5HGKN:GDB7eKg20RrXrrvJvjA0aG6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879694, "uuid": "1d4548dc-59cb-4852-8836-a4ab66f58b36", "value": 102034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879694, "uuid": "aea9ac30-bb7b-40e0-ae43-ba8fb62d1920", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879694, "uuid": "abbda491-df44-4895-ac80-9ad2b4a4254a", "value": "invoice-1637482117.pdf (55).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846d8d5f-da76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886301, "uuid": "3eb5f5f7-47d3-4e54-aa85-c2e90cc6a4a5", "comment": "Malware payload (Mirai)", "value": "37606f69e3e2c624596d15648284e599", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886301, "uuid": "dd565181-d8dd-4e27-859f-fcf84d81763a", "comment": "Malware payload (Mirai)", "value": "fc1f019373f9b3b084b2464ea3a14ee4fde68fb9dfdd4b43c980c60538cdcd40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886301, "uuid": "e39beb21-2408-4ef4-a97f-44c5183f197e", "comment": "Malware payload (Mirai)", "value": "7d81085fd2f5ab29b56c5a4de3a77337374014c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886301, "uuid": "915953c8-087b-43ca-a8ea-26b718bca7dd", "comment": "Malware payload (Mirai)", "value": "41cb4627b432a55b31fb246e55b2d0211d48a688dd3bcb325c2f651a7228a9b8087090808b1fd51e90183b75f7057dc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886301, "uuid": "0fce7acf-f0ef-4827-949c-e155f7e135b5", "value": "T1FDF3A2097B611EBBD85BDD3746E84B4919CC610736B83B3539B4E904FA4B58F0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886301, "uuid": "90844876-e90d-40f1-a149-3eaa799e7148", "value": "1536:UsyN5EV+YV2ud++slrSUIFMRbh7xrKcQP02HCbFEGythnRNIP/l4v7unoBwDFZ8+:Usvc7uddslr/bXr+X4tRlDr8nm5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886301, "uuid": "16ba4a5a-1e84-46ae-96ba-ac0064580751", "value": 159672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886301, "uuid": "de4c3679-e45a-4b1c-aacd-44efde8e519c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886301, "uuid": "d7df6095-607d-4d89-858b-3ba0bce9aaf5", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec220772-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765880032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880032, "uuid": "bd4226df-2741-4473-a56a-4b8728289f42", "comment": "Malware payload (Rhadamanthys)", "value": "060ead5e1b0dbcb3dbe5a651378db3ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880032, "uuid": "4fc55d58-8fed-4465-98ad-e193c9dd630e", "comment": "Malware payload (Rhadamanthys)", "value": "fc1f5611bd81c45cdfbe4f27838ef6bcb8a7e8af05729f00d78dbdadb5e81068", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880032, "uuid": "7a6f011a-1229-4c12-8d2d-c936465d314e", "comment": "Malware payload (Rhadamanthys)", "value": "9c55a5946f631685940e80dbe314861053e08a9c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765880032, "uuid": "ee52eef5-d4bd-4c0e-ab9c-4932eb243d10", "comment": "Malware payload (Rhadamanthys)", "value": "ba981d1e04ddc09233fc6aecec090ad433fbcef8daa2e04394bc50ac8528972058492b9b3c7f6a76f9350b7aae4b3f6e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880032, "uuid": "2d34a48b-835a-460a-8d83-838dfd30e8d7", "value": "T120A32D35BC43ACE746466BA319E60F5AD87C43DE9E6256D12A1E638920EDF06703D0F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880032, "uuid": "438f3ad6-e33a-40c8-9ab2-8b5aa4516ebe", "value": "1536:GDB7eKg20x3lrur8vd8HmyaIaAlj0dgw6BkQWJ+aY:GDB7b030UZPgw6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765880032, "uuid": "168cf208-67cc-461b-b520-3e9fd5ad80ee", "value": 100046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765880032, "uuid": "62f802d7-ad1b-4bbb-a8ce-42a0a4e32d69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765880032, "uuid": "d52690c9-d5df-43e1-8664-f766212d6f92", "value": "invoice-1637482117.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8097fd-dab0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765911141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911141, "uuid": "5e338d3f-91be-4a7f-bc95-f92c1927a761", "comment": "Malware payload (Mirai)", "value": "520f201b5470409dc3e180a1600ae91a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911141, "uuid": "5533bd75-4afe-4d33-91f2-f7ea214da673", "comment": "Malware payload (Mirai)", "value": "fc6c565d1cbb0bd49e6882769fe41adc8694d16e04c7543f26c27f717270e237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911141, "uuid": "df765c1e-ade1-4aa1-9aed-9e19451150b6", "comment": "Malware payload (Mirai)", "value": "7fb4cbb35aae02e49c8d89c4153da937810352ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765911141, "uuid": "f818a877-1d83-412e-8e26-2d3fe8c17d76", "comment": "Malware payload (Mirai)", "value": "1b0ed96ce64b8015dccb54ca538a77c7dbe6b88b94288eb492765516578b51fe7c3c3242914f3bb7c43fb455dd638b7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911141, "uuid": "3c769abd-2965-4ff3-b5f8-93ad434df792", "value": "T129C3E885AC418B21C5D723FBFE6F518C33161398E3DEB11F9C116B66778A0270E3A95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911141, "uuid": "645bcb14-c699-47fb-810b-f00496077663", "value": "3072:6A2eint0g6Almitp5utgf/rbOURUX35Vnr5J:6A9inSg6AlHp8t+/ryUiH5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765911141, "uuid": "b81e032f-9eab-4eaa-84c4-d3664b964331", "value": 129060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765911141, "uuid": "13d1f960-406a-4e4f-b277-2b9cca91cd8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765911141, "uuid": "1c7f6e97-3734-4a1e-849d-2fe477995a46", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1805c8c6-dab5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765913177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913177, "uuid": "65489793-5920-4ffd-8d6e-42a284b1e372", "comment": "Malware payload", "value": "a73fabfd66e24620342bb19e7d5c4366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913177, "uuid": "752bbc5f-9953-4293-8e64-4ac098db3264", "comment": "Malware payload", "value": "fcbd845fb5792202f65e39fde2df87357e1bd670fb9666b19df99d7ff9763f4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913177, "uuid": "e21cc7d6-9a75-45a6-b647-56898c60d26e", "comment": "Malware payload", "value": "d7e8f2d05b9fd1d4d8c7fb899f313d6e7e4dd16a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765913177, "uuid": "6c0fe562-95d7-43b8-b468-bbb0d0483526", "comment": "Malware payload", "value": "77bb3168cc4b947a0b5c96a7f960db2365a44ea81c7db8ec45d55c86cbb1bb72e408fef476422b21170105eb131bf861", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913177, "uuid": "34ce38e9-739f-4f97-a711-3a21139358af", "value": "T170C307957C42AB52C6D726BBFF5E02AC332613A4D3DE7107AC206B5A73CB1160E3E945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913177, "uuid": "648f39e1-1c32-4df7-9618-d03bfeda13a5", "value": "1536:dGXmcK2Fm89lnwR3FC+MZ8zwzz+pDPm2TIS8gVJGbFOb2QyHvN8nXhVR15:dG2PbeZ8zsgI3gVAbAQPN8nXz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765913177, "uuid": "3c96a0c4-b9cc-4638-be82-a9ecf3a53bd3", "value": 124096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765913177, "uuid": "0d0d5c78-1d6e-40d7-8a20-304a07031c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765913177, "uuid": "4f92f3e0-d91d-4b85-a849-d6fd322eb808", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935039b2-da8b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895345, "uuid": "c43e7544-a42d-450f-be66-a7c0ef419e41", "comment": "Malware payload", "value": "55c30ea60b114d29ee2935d9428f35c5", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895345, "uuid": "0bb9982b-5e8b-4a36-8849-d004c332e2f7", "comment": "Malware payload", "value": "fd41f268a1dbe0e0e5e6385f1bde034d04b3dc75f1f195acd0d630b7ee395230", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895345, "uuid": "cc798340-2dcd-4924-a24f-3980aedefddb", "comment": "Malware payload", "value": "f41a16f1e5ac1923103496d8feca082b94ab7c3f", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895345, "uuid": "0c394d0e-3bdf-4d60-b09e-058fe765e348", "comment": "Malware payload", "value": "8324bbd0567c6ae670ad8e76c631f44d7fbad5242cc9039c1a6b5b7d94f3d84ea2bed5ea2113f8ba8370337f7a248229", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895345, "uuid": "2e3244f8-877d-479f-8e07-d11bd13caa7a", "value": "T17EA533394E5D1494D0CFDAC215A2B6A0D86614FCCBFCAD0832E5E508BB7FDE86A41D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895345, "uuid": "05a9a778-6d8f-482d-ba19-4d16dd0fe48e", "value": "49152:g1VTEKyPAZhiuuOh+ouhw7H8EG14Qb/IMZ:gfExAZhzKhw1K5dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895345, "uuid": "3cd5d1f3-5cd4-4bd9-92a5-75ff1e9c9480", "value": 2222631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895345, "uuid": "4f445200-74f0-491d-b103-63c3f9849ff1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895345, "uuid": "e4a4a6e1-1da0-4082-90c5-7acd4f72545b", "value": "FG-PNC-E2-AA-BOD-0010-07 - Project Design.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c82663-da28-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765852775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852775, "uuid": "60f3edeb-5fed-44bd-884e-dcecfb10c05f", "comment": "Malware payload (Gafgyt)", "value": "62500f70972eadd2cbcede2422216f27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852775, "uuid": "faeed04f-e069-4e44-8db5-5d1d67152e5d", "comment": "Malware payload (Gafgyt)", "value": "fdf17077c9f679e10acf3727d65e45d8b09caee965d0d0010f584d3947fdaa0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852775, "uuid": "ec8e4c3e-6e06-4f7b-a016-dae2bc648f43", "comment": "Malware payload (Gafgyt)", "value": "0e2545c12ff427172c00271298d134696c2cdefb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765852775, "uuid": "961c3f9b-4aee-410d-a4e8-4ddccfc2e2fe", "comment": "Malware payload (Gafgyt)", "value": "6d272885582f3f8980d6a061d5b1396af4d1d795b1eff9fa9aeb19ba7ece20446e8a3490e4a45837d939e7062e22b2a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852775, "uuid": "9b10a550-8fb9-4c7e-9e32-eca680679e6d", "value": "T175B32901F941872BC3D327BAE78E479C3B356A9457D733016A397EB42BC27D82E29521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852775, "uuid": "95ae5400-02da-4504-af0e-cb18857a8af6", "value": "3072:xhFJsRqE+epkOnniP3QdEmkorQOhPOCXMAX:Jaz+eKOniPtmkorQOhPOCXMAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765852775, "uuid": "4a4d9c4a-2f85-4f25-bc70-bd79455eec36", "value": 108598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765852775, "uuid": "5a7ae19a-4bc2-4654-be3a-bb9e2a7d1421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765852775, "uuid": "8459b5ac-c3a4-4930-8ccc-ca18edb7c973", "value": "Fantazy.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1353f275-da4b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765867643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867643, "uuid": "203f7ceb-37d4-44da-b62b-8c794f1a1741", "comment": "Malware payload", "value": "1cd678bb01d8b09d1f911966a0b0c1dd", "object_relation": "md5", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867643, "uuid": "640b7206-2741-4023-bd35-7048ddb20b99", "comment": "Malware payload", "value": "fdf3168ca2992a739d7ca5b314640d0641fdf67ae8e03ba8329821f40a6cb5c4", "object_relation": "sha256", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867643, "uuid": "baa7bce0-b4cd-4558-9664-14d3d545414b", "comment": "Malware payload", "value": "3575dac5057bb68f8250f336a1882bbdd47faca6", "object_relation": "sha1", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765867643, "uuid": "1d1a3976-1e30-4630-adf4-809632b9bd65", "comment": "Malware payload", "value": "4bc1156dbd73417bec0a1eade76b34a7045441f08577342482aedaf61a3982449592dc433954491447c43b63fb142e1e", "object_relation": "sha3-384", "Tag": [ { "name": "Phsep30", "colour": "#51DA64", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867643, "uuid": "0ff14a1e-d561-4410-80c4-4f0905fc4eb9", "value": "T1F45633B351ED6D7479500834BE8AFD0D6323CF4A10F8D9363E732059A9394E72AAED46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867643, "uuid": "3edc1a08-5eb0-4fd1-93cb-d09c204407ca", "value": "98304:8Hbc/+XrxNru+1BvUbckl+JzIx6k41zW34SUaW9b+eiMyODkyyJYg4HWKhCZvvRH:8HAWXrXLzUW5tW3OJ9bdJWulmvR33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765867643, "uuid": "74545e38-2f52-4d96-84ad-6abbd93c528d", "value": 6403107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765867643, "uuid": "8aec3461-7ea9-49fe-81fd-97e19dd0d3c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765867643, "uuid": "ae850c1d-fee3-4a10-ae1a-a7651faf402a", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e37602-da5e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765876176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876176, "uuid": "68d73975-e535-4459-9479-01bc641a2d99", "comment": "Malware payload", "value": "3a726c4dcd2fcdf57846b6c3fd24a174", "object_relation": "md5", "Tag": [ { "name": "CYPH3R", "colour": "#A40C0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876176, "uuid": "14274991-388b-42fc-9cfb-2a1b314384f5", "comment": "Malware payload", "value": "fe02d8d7a6b8f66624b238665d63094a2bcd19c44a3f9c449788cadbb1b741a6", "object_relation": "sha256", "Tag": [ { "name": "CYPH3R", "colour": "#A40C0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876176, "uuid": "4412e251-8402-4c76-b72d-3afb3804a741", "comment": "Malware payload", "value": "9cf8f53530ca2a4cd64c46c8cf7a294fec85883d", "object_relation": "sha1", "Tag": [ { "name": "CYPH3R", "colour": "#A40C0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765876176, "uuid": "c6085b00-a756-4051-a511-c8b53ad8a4d8", "comment": "Malware payload", "value": "08e25c1c78b219af5af4a301909a5e93785ac0a7aeac4faa2cb98e8e340cde4eacbbd541eafcdd0fa3a92afae703f7ee", "object_relation": "sha3-384", "Tag": [ { "name": "CYPH3R", "colour": "#A40C0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876176, "uuid": "c39523b5-c03c-4185-ab44-4ef9d1130080", "value": "T1FA83124126FBB219F6B73B705EBFD5644A3A7CD5A87AC61D1284047F1EE1A008DA3732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876176, "uuid": "f3d548c9-3ecc-4879-be96-1d16f1cc21b8", "value": "1536:9TvDb8g5VhTRTewBeEyKsqFSSWWpab+/30:9zDjTRRTenD2p30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765876176, "uuid": "f2aa4825-d584-4294-94dd-5390b73a6fd6", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765876176, "uuid": "d0a57b30-bd8c-4f66-b2d3-28ba11ef5551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765876176, "uuid": "3c000bf0-31d6-438c-abe6-d5eb023f823f", "value": "WinUpdateHelper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0215440b-da67-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765879639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879639, "uuid": "dd14b719-db5e-414d-98e3-23c4bfac497f", "comment": "Malware payload (Rhadamanthys)", "value": "7697c01b672201824a4335a6645121d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879639, "uuid": "99643205-d292-4925-98c6-6d912f9811e8", "comment": "Malware payload (Rhadamanthys)", "value": "fe06e50dc8478a1e66826da7c1a994134446126e6d4a0c9fe81306a32cb00cd2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879639, "uuid": "bbd8f65d-857c-4cb1-b028-b08c5369e1aa", "comment": "Malware payload (Rhadamanthys)", "value": "e3ab149311464a333b801ff4409f1b884896bcc0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765879639, "uuid": "6d8d25e4-8386-4d18-8ee5-425b3b72506c", "comment": "Malware payload (Rhadamanthys)", "value": "74de6221a5fbf399c76360dfa367e9b50ccaec4565708a22dbf1338439c79e62c09140f5e1803db9cd762ba2786c612e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879639, "uuid": "9d9e3f59-6683-4d23-9a39-5931e6830e03", "value": "T120A3F8117BABBCF9178F152C88BF3EAA884E26131840508D717F3D6571A4D6B865F8CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879639, "uuid": "a3a96832-cda5-425b-9411-3cc7a724190d", "value": "1536:GDB7eKg20WVdrrrKEeLy+sFKpA2vg3wY6BkQWJ+aY:GDB7b0aXXSuwY6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765879639, "uuid": "9808385e-ede9-49dd-aec5-f64b9a720ad7", "value": 98759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765879639, "uuid": "e4d0b25f-60e7-4b1e-9d19-0d1665b63bfb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765879639, "uuid": "d450a07e-a2d2-443c-be61-67f27c5eaa4b", "value": "invoice-1637482117.pdf (66).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2466db4b-da77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765886569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886569, "uuid": "704fab37-6e6d-44ea-8664-264fad190cb6", "comment": "Malware payload (Mirai)", "value": "730f60ddf202f2c527edab9f41ba7323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886569, "uuid": "58e9a3fb-ebd3-4834-81f1-64c19bd8ad29", "comment": "Malware payload (Mirai)", "value": "fe701a833118c97598dde2e620e8cf1228aa98a97bb4aa90b9bd766018dcdb39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886569, "uuid": "f6ff9644-2f1f-4633-abdc-89179f584fa1", "comment": "Malware payload (Mirai)", "value": "6f5e528391a9d8a788b2c58eb328c098d8592d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765886569, "uuid": "8364c42f-28ee-439e-aab0-711cabf82ada", "comment": "Malware payload (Mirai)", "value": "d7f7663a6797866bedd16e2326af80bd4af6d98faf80ad6e1fd5ebe46ab28ff5693b97d86ea2719afbfd03ef03623116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886569, "uuid": "b85db004-069e-421c-b4c8-0555e2788d87", "value": "T1FFD3A74EAE618F7EF1BC53B587B34B20DE55229336E1C680E66CE9215D7031CA42FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886569, "uuid": "773e19d2-2349-423c-aa6a-2cd6bf895d45", "value": "3072:irtA4GJjtPRrg+7loSXIRIGOgxXnrEaFoJc9unk7yk36Np4b6WQuQGQgifrsBC8d:irtA4tmSvinMWXSbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765886569, "uuid": "c484acf3-0b75-4337-8c22-ff2b28440dc7", "value": 131152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765886569, "uuid": "d05ba30b-4cca-42bb-8aa8-16b4eb7a121f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765886569, "uuid": "c6e31893-aafc-4767-85ed-8f25e35a8417", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ef8677-da70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765883562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883562, "uuid": "d101ad89-008e-47c8-96f5-f587d79b53d0", "comment": "Malware payload (Mirai)", "value": "416488ce11a1323525667fb6794444ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883562, "uuid": "d8d0581b-5215-4399-ae3c-9d444a8f9fc6", "comment": "Malware payload (Mirai)", "value": "fefe173418c3612d3fa583e8d60c8c8a978b2df99ca70605e14224cc8055b2a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883562, "uuid": "dc74149a-6204-4b7d-89b5-acd90bd26870", "comment": "Malware payload (Mirai)", "value": "51799eabe31de9c57f6125fad883fb64b2206957", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765883562, "uuid": "3332b9c5-7b36-4703-bd1d-430ae77d7ae3", "comment": "Malware payload (Mirai)", "value": "5a1d78399df64b5695c4439026abdd48bc7dbf8beae9888455000ff3d653a332af05232a41bc955adf135bcb2ac98c0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883562, "uuid": "9cb4fa22-985a-442a-8d7d-c20b0423641f", "value": "T16B83D887B3184343E0524BF5EE2E67F4DFA97EE015B8BA4C181B2A0954B5C364146FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883562, "uuid": "f82c44a0-b649-4038-a36c-38d9e2da885b", "value": "1536:2Xz2YYl7n7zQwzKQ313PqWeaSGsU8nF5QIl+:JY4zD13SGd8nF5QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765883562, "uuid": "f7609eea-984d-4546-8822-017eefa49e1a", "value": 87856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765883562, "uuid": "e3cf4e5b-b197-475c-9bbe-c7e15e97062e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765883562, "uuid": "5af04d9b-284c-4551-a9ca-de6cc16d6438", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9056918c-da8b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765895340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895340, "uuid": "721d80b9-245b-47a9-b3ad-10de218be1dc", "comment": "Malware payload", "value": "4a0698033519c0bb057201cf82dddae8", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895340, "uuid": "b87cdce6-9f99-458c-9176-1a28adda6415", "comment": "Malware payload", "value": "ffe20d069d7860e19a6e151597a4425d6a79bbd0a97e919e401003ee186f42d9", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895340, "uuid": "aca205b2-0383-4908-8bbd-5558c81af006", "comment": "Malware payload", "value": "b2d588bb67594cceda7db714e8bfb260d918922d", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765895340, "uuid": "dedf04ed-08bb-4d77-a6eb-b575e968a078", "comment": "Malware payload", "value": "02a3310e800bc68c101ae92dbc77fa4f482a7b5904591e832e1e5bc334c052e4804cf4cb07f1f20bae9b0d332a58bace", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895340, "uuid": "75cea841-9c31-4fc5-a109-4d20a228040f", "value": "T1FCD502BB98B269536A904667EB0F2C1E335B19D03B54D341EA51905C7F3B1D38EA2B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895340, "uuid": "f27b3694-ab36-4c14-a167-35ccb94b3445", "value": "49152:iOc2yD4lTP99Ha449bQa5mC/rJHjNgv7CqkU7o28D57o:ioyEFP9iFBmCTJpgv7CYo2S57o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765895340, "uuid": "959c5c11-25a1-459f-be98-2d30185a99a1", "value": 2906063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765895340, "uuid": "75400e4b-5f23-4ca9-8632-fdf95823d437", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765895340, "uuid": "fa8e7652-37b4-41c5-a936-6ec5bbd59a38", "value": "ANNEXURE.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a25944-daad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765910012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910012, "uuid": "3df31ee4-e093-4015-8c4e-6c264bc2c024", "comment": "Malware payload (Mirai)", "value": "f6b151d9f46b420a9343b8c9afb18362", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910012, "uuid": "c896d399-4621-4a8e-8bed-f9c6189730bf", "comment": "Malware payload (Mirai)", "value": "ffe2acaafd74c1e7306297f3b2b996532226757a5bd7b64c4c242f9ffad72e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910012, "uuid": "c771c279-df12-44a5-a637-5313f6d4232b", "comment": "Malware payload (Mirai)", "value": "d8a37f64f762be7b0948b0b4e5d4a04bfe45aff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765910012, "uuid": "f6525408-e5eb-4db7-953d-8398a680c88c", "comment": "Malware payload (Mirai)", "value": "86437b4f64e250cc974bab096426314dae4326fca44c78fa91b853f39feed7c70034bfe26596568a5e5d40fed7c89a11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910012, "uuid": "7bc1bc1e-d7bc-4344-9fac-2b905238afd3", "value": "T133D3F645AC408B21C9E723FBFE5F518C335353A8E3EAB116EC182B55779A51B0F3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910012, "uuid": "509cac60-49e5-4b53-a1b6-db1a44b98ac6", "value": "3072:v4RxmC5M7sFt57n6Ou59LXNxJwIywslDGfwn9toVnr5:v4RIC5ysFt3uLLdxJwIyw4DGfE9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765910012, "uuid": "efc2de6d-b700-459e-bfe7-d88329fbc97b", "value": 142516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765910012, "uuid": "ecde421e-a771-4f6b-8004-47130dbd6b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765910012, "uuid": "63f84b37-922e-4972-8418-7b1d1ebdffcc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }